Cross-Site Scripting Vulnerability in OpenAtlas by Austrian Centre for Digital Humanities

CVE-2025-40705

What is CVE-2025-40705?

A Cross-Site Scripting (XSS) vulnerability exists in OpenAtlas v8.9.0 developed by the Austrian Centre for Digital Humanities and Cultural Heritage. The flaw arises from inadequate validation of user input, particularly during the execution of a POST request. This vulnerability could potentially allow an attacker to execute malicious scripts in the context of an authenticated user’s session. By sending specially crafted payloads through the '/insert/acquisition' endpoint using the 'name' parameter, the attacker may be able to extract sensitive session cookie information, posing a significant risk to user data integrity and confidentiality.

References