CVE-2025-11183: Cross-Site Scripting Vulnerability in QWC2
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.
Other sources
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/qwc2to a version that resolves this vulnerability.Fixed in 2025.08.14
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11183?
CVE-2025-11183 has been categorized as a high severity Cross-Site Scripting (XSS) vulnerability.
How can I fix CVE-2025-11183?
To fix CVE-2025-11183, upgrade to the latest version of QGIS QWC2 beyond 2025.08.14.
Who is affected by CVE-2025-11183?
CVE-2025-11183 affects all users of QGIS QWC2 versions prior to 2025.08.14.
What type of attack can be executed using CVE-2025-11183?
CVE-2025-11183 allows an attacker to execute arbitrary JavaScript code within the web application.
Is authentication required to exploit CVE-2025-11183?
Yes, CVE-2025-11183 requires the attacker to be an authorized user to exploit the vulnerability.