Skip to content
OpenAdvisories

Vendor

qgis

3 known vulnerabilities.

Products

QGIS 2 QWC2 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-104140

    QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values

    QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 (OGC API Features) HTML responses without HTML escaping. Attacker-controlled feature.properties value…

    qgis QGIS qgis qgis Debian Ubuntu
  • Medium 6.9
    CVE-2025-11183

    Cross-Site Scripting Vulnerability in QWC2

    Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page

    qgis QWC2 qwc2 npm