{"id":"GHSA-gxp8-m5rq-3m38","revision":"21e90bc11409473a8ad098c2baf3db7a","records":[{"revision":"21e90bc11409473a8ad098c2baf3db7a","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-gxp8-m5rq-3m38","aliases":["CVE-2025-11183"],"title":"QGIS QWC2 Cross-Site Scripting vulnerability","description":"Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.","state":0,"publishedAt":"2025-10-13T12:31:10+00:00","modifiedAt":"2026-09-10T03:50:29.7825166+00:00","affected":[{"ecosystem":"npm","name":"qwc2","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2025.08.14"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/RE:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-11183","https://github.com/qgis/qwc2","https://hub.ntc.swiss/ntcf-2025-4286"],"sourceUrl":"https://github.com/advisories/GHSA-gxp8-m5rq-3m38","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gxp8-m5rq-3m38","identifiers":["GHSA-gxp8-m5rq-3m38","CVE-2025-11183"]},"retained":false,"historicalAffected":[]}],"coverage":[]}