{"id":"CVE-2025-11183","kind":"vulnerability","aliases":["CVE-2025-11183","GHSA-gxp8-m5rq-3m38"],"related":[],"title":"QGIS QWC2 Cross-Site Scripting vulnerability","description":"Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.","summary":"QWC2, a web client for QGIS map servers, has a cross-site scripting flaw in its attribute table. An authorized user can plant arbitrary JavaScript that runs in other users' browsers.","severity":"medium","cvss":6.9,"epss":0.0042,"exploited":false,"exploited_at":null,"products":[{"name":"qwc2","fixed":["2025.8.14"],"affected":"< 2025.8.14","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-79","npm","package","qgis","qwc2","web-gis"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed version of the `qwc2` npm package, for example with `npm ls qwc2`.\n- Look at the `qwc2` entry in `package.json` and `package-lock.json` for a version below `2025.8.14`.","fix":"- `qwc2` `2025.8.14`","status":"open","published_at":"2025-10-13T10:15:45+00:00","first_seen_at":"2026-11-05T21:08:59+00:00","triaged_at":"2026-11-05T21:09:58+00:00","updated_at":"2026-11-05T21:10:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T21:09:58Z","model":"claude-haiku-5-5","output":{"fix":"- `qwc2` `2025.8.14`","reach":"internet","title":"QWC2: attribute table cross-site scripting lets an attacker plant JavaScript","impact":"medium","summary":"QWC2, a web client for QGIS map servers, has a cross-site scripting flaw in its attribute table. An authorized user can plant arbitrary JavaScript that runs in other users' browsers.","audience":"developers","category":"package","nicknames":[],"who_cares":["qwc2","qgis","npm","web-gis"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in other users' browsers, session data exposed","analyst_note":"","how_to_check":"- Check the installed version of the `qwc2` npm package, for example with `npm ls qwc2`.\n- Look at the `qwc2` entry in `package.json` and `package-lock.json` for a version below `2025.8.14`.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Teams that run a QWC2 web client built from the npm package at a version below 2025.8.14, where users with an account can view attribute tables. The sources do not describe a configuration that makes this safe, so treat any deployment below the fixed version as exposed. Deployments that only serve static builds from a fixed version are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4229,"output_tokens":508,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11183':10A,18A '-2025':9A,17A '-79':21B '2025.08.14':72C '3m38':15A 'allow':73C 'arbitrari':53B,79C 'attack':76C 'attribut':46B,67C 'author':49B,75C 'browser':60B 'client':32B 'code':81C 'cross':4A,40B,62C 'cross-sit':3A,39B,61C 'cve':8A,16A 'cwe':20B 'flaw':43B 'ghsa':12A 'ghsa-gxp8-m5rq-3m38':11A 'gis':28B 'gxp8':13A 'javascript':54B,80C 'm5rq':14A 'map':35B 'npm':22B 'packag':23B 'page':84C 'plant':52B,78C 'qgis':1A,24B,34B,70C 'qwc2':2A,19A,25B,29B,71C 'run':56B 'script':6A,42B,64C 'server':36B 'site':5A,41B,63C 'tabl':47B,68C 'user':50B,59B 'vulner':7A,65C 'web':27B,31B 'web-gi':26B","nicknames":[],"mitigations":[],"who_affected":"Teams that run a QWC2 web client built from the npm package at a version below 2025.8.14, where users with an account can view attribute tables. The sources do not describe a configuration that makes this safe, so treat any deployment below the fixed version as exposed. Deployments that only serve static builds from a fixed version are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["qwc2"],"ptokens":["qwc2"],"labels":["cwe79","medium","npm","package","qgis","qwc2","webgis"],"campaign_type":null,"first_public_at":"2025-10-13T10:15:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:L/U:X","cvss_by":"vulnerability@ncsc.ch","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gxp8-m5rq-3m38","url":"https://github.com/advisories/GHSA-gxp8-m5rq-3m38","severity":"medium","published_at":"2025-10-13T12:31:10+00:00","modified_at":"2026-11-05T21:07:15+00:00","first_seen_at":"2026-11-05T21:08:59+00:00","fetched_at":"2026-11-05T21:19:01+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-11183","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11183","severity":null,"published_at":"2025-10-13T10:15:45+00:00","modified_at":"2026-10-23T22:10:00+00:00","first_seen_at":"2026-11-05T21:10:30+00:00","fetched_at":"2026-11-05T21:10:30+00:00","note":null}],"documents":[],"exploit_sources":[{"type":"epss","score":0.0042,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-11183"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}