medium6.9
CVE-2025-11183
QGIS QWC2 Cross-Site Scripting vulnerability
Impact
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 < 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | qwc2 | < 2025.08.14 | 2025.08.14 |
Affected products
| Product | Affected versions |
|---|---|
| QGIS QWC2 | before 2025.08.14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.