CVE-2025-40649

Stored XSS in BBMRI-ERIC Negotiator v3.15.2 due to insufficient validation of user-supplied data in the text parameter of POST /api/v3/negotiations//posts. A remote attacker could craft input to exfiltrate or steal the cookie session details of an authenticated user. The issue is concrete in the ...