CVE-2025-51536

CVE-2025-51536 affects OpenAtlas v8.11.0 from the Austrian Archaeological Institute. The root cause is a hardcoded Administrator password within the OpenAtlas system, enabling an attacker to potentially gain privileged access. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a 9.8...

CVE-2025-40708

OpenAtlas v8.9.0 is affected by a Cross-Site Scripting (XSS) flaw triggered by insufficient validation of the name field in the POST /insert/event API. An attacker could craft queries to an authenticated user and potentially steal session cookie details. The issue is corroborated by multiple sour...

CVE-2025-40705

OpenAtlas 8.9.0 is affected by a Cross-Site Scripting (XSS) vulnerability caused by inadequate validation of user input in a POST to /insert/acquisition (name parameter). This could allow a remote attacker to craft queries that are processed for an authenticated user, potentially exfiltrating ses...

CVE-2025-51534

OpenAtlas v8.11.0 from Austrian Archaeological Institute is affected by a cross-site scripting (XSS) issue that allows injecting a crafted payload into the Name field to execute arbitrary web scripts/HTML. CVSS v3.1 base score 8.1 (HIGH) with NETWORK attack vector, low attack complexity, user int...

CVE-2025-60915

CVE-2025-60915 affects Austrian Openatlas: an issue in the size query parameter of /views/file.py allows path traversal with a crafted request in versions before v8.12.0. Impact is access to restricted paths; remediation is upgrading to v8.12.0 or later (no exploitation details provided in the do...

CVE-2025-40706

The CVE-2025-40706 entry concerns OpenAtlas v8.9.0 (ACDH-CH). Affects the OpenAtlas insert/source endpoint where the POST parameter name is inadequately validated, enabling Cross-Site Scripting (XSS). The vulnerability could allow a remote attacker to craft requests to an authenticated user and s...

CVE-2025-40702

OpenAtlas v8.9.0 (ACDH-CH) is affected by a Cross‑Site Scripting (XSS) flaw caused by inadequate validation of user input in a POST to the /insert/file endpoint, specifically via the creator and license_holder parameters. Multiple sources (NVD, Red Hat, CVE lists, and OSV) confirm the vulnerabili...

CVE-2025-60917

CVE-2025-60917 is a reflected XSS in Austrian Archaeological Institute Openatlas prior to v8.12.0, discovered via the /overview/network/ endpoint where an attacker injects a payload into the color parameter to run code in a user’s browser. The vulnerability arises from unvalidated/reflected input...

CVE-2025-51535

CVE-2025-51535 affects OpenAtlas v8.11.0 from Austrian Archaeological Institute. A SQL injection vulnerability is present (root cause not explicitly detailed in the documents). Impact is rated high (C/H/I/A) with CVSS v3.1 base score 9.1 (network, high risk, high privileges required, no user inte...

CVE-2025-40703

CVE-2025-40703 describes a Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 (ACDH-CH). The issue arises from inadequate validation of user input in a POST request to the “/insert/group” endpoint, specifically the parameters “name” and “alias-0”. A remote attacker could craft inputs to...

CVE-2025-40709

OpenAtlas v8.9.0 is affected by a Cross-Site Scripting (XSS) vulnerability due to inadequate validation of user input in POST requests to /insert/person/, specifically the name and alias-0 parameters. The issue could allow a remote, authenticated attacker to craft queries that steal session cooki...

CVE-2025-40707

OpenAtlas v8.9.0 contains a Cross-Site Scripting (XSS) flaw due to inadequate validation of POST input. The vulnerability affects the /insert/place endpoint, specifically the name and alias-0 parameters, enabling a remote attacker to craft queries that could steal session cookie details from an a...

CVE-2025-56423

CVE-2025-56423 affects OpenAtlas v8.12.0 from the Austrian Academy of Sciences. A login error message handling flaw can disclose sensitive information to remote attackers, exposing confidentiality. Connected sources (Red Hat, EU ENISA, OSV, NVD, CVE listing) corroborate the issue description but ...

CVE-2025-40704

The CVE-2025-40704 entry concerns OpenAtlas v8.9.0 (ACDH-CH). Affected component is the POST /insert/edition endpoint, with the vulnerability due to inadequate validation of the name parameter in user input. This can allow a remote attacker to craft queries that reach an authenticated user and po...

CVE-2025-60916

CVE-2025-60916 is a reflected XSS vulnerability in Austrian OpenAtlas. The issue affects the /overview/network/ endpoint prior to OpenAtlas v8.12.0, where an attacker can inject a crafted payload into the charge parameter to execute arbitrary JavaScript in a user’s browser. The Red Hat/EU ENISA/O...

CVE-2025-60914

CVE-2025-60914 describes an access-control flaw in the Austrian Archaeological Institute Openatlas prior to version 8.12.0, where a crafted GET request to the path /display_logo can disclose sensitive information. The affected product is Openatlas (by the Austrian Archaeological Institute). The u...