~ / search / GHSA-gxp8-m5rq-3m38

GHSA-gxp8-m5rq-3m38

QGIS QWC2 Cross-Site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-11183

Packages

EcosystemPackageAffectedFixed in
npm qwc2 < 2025.8.14 2025.8.14

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.

References

External links from the advisory. They lead to third-party sites.