Qgis
Monthly
Stored cross-site scripting in QGIS Server's WFS3 (OGC API Features) HTML renderer allows an attacker who can write feature attributes into a published writable vector layer to inject markup or script that executes in the QGIS Server origin when a victim opens an items or feature HTML page. Affected releases are QGIS Server versions prior to 3.44.12 and the 4.x line from 4.0.0 through 4.2.3; exploitation requires the WFS3/OGC API Features interface to be enabled and serving HTML, a writable published layer the attacker can populate (for example through WFS-T transactions), and a user who actually views the crafted page. The vendor rates this CVSS 6.1 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while our independent assessment applies the same score but a PR:L vector because the attacker must hold write access to a published layer; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Stored cross-site scripting in QGIS Server's WFS3 (OGC API Features) HTML renderer allows an attacker who can write feature attributes into a published writable vector layer to inject markup or script that executes in the QGIS Server origin when a victim opens an items or feature HTML page. Affected releases are QGIS Server versions prior to 3.44.12 and the 4.x line from 4.0.0 through 4.2.3; exploitation requires the WFS3/OGC API Features interface to be enabled and serving HTML, a writable published layer the attacker can populate (for example through WFS-T transactions), and a user who actually views the crafted page. The vendor rates this CVSS 6.1 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while our independent assessment applies the same score but a PR:L vector because the attacker must hold write access to a published layer; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.