Cross-Site Scripting Vulnerability in OpenAtlas by Austrian Centre for Digital Humanities

CVE-2025-40705

What is CVE-2025-40705?

A Cross-Site Scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 developed by the Austrian Centre for Digital Humanities and Cultural Heritage. The flaw arises from inadequate validation of user input, particularly during the execution of a POST request. This vulnerability could potentially allow an attacker to execute malicious scripts in the context of an authenticated user’s session. By sending specially crafted payloads through the '/insert/acquisition' endpoint using the 'name' parameter, the attacker may be able to extract sensitive session cookie information, posing a significant risk to user data integrity and confidentiality.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References