Medium · 6.9 CVE-2025-11183 EUVD-2025-34062GHSA-gxp8-m5rq-3m38

Cross-Site Scripting Vulnerability in QWC2

Published Oct 13, 2025 · Updated Oct 14, 2025 · Assigned by NCSC.ch

Vendor: qgis Product: QWC2 Package: qwc2 Ecosystem: npm

Description

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14
allows an authorized attacker to plant arbitrary JavaScript code in the page

Affected products

Vendor	Product	Affected	Fixed
QGIS	QWC2	< 2025.08.14	2025.08.14

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	qwc2	< 2025.8.14	2025.8.14	GHSA-gxp8-m5rq-3m38

References

https://hub.ntc.swiss/ntcf-2025-4286 technical-description