Medium · 6.9 CVE-2025-11184 EUVD-2025-34061GHSA-qhh9-jphj-p4xw

Cross-Site Scripting Vulnerability in QWC2 Registration GUI

Published Oct 13, 2025 · Updated Oct 14, 2025 · Assigned by NCSC.ch

Vendor: qwc-services Product: qwc-registration-gui

Description

Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31
allows an authorized attacker to plant arbitrary JavaScript code in the page

Affected products

Vendor	Product	Affected	Fixed
qwc-services	qwc-registration-gui	≤ v2025.03.31	2025.09.30

References

https://hub.ntc.swiss/ntcf-2025-7724 technical-description