CVE-2025-40706

CVE-2025-40706 describes a Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH). This flaw allows a remote attacker to inject malicious scripts into the "name" parameter of the "/insert/source" petition due to insufficient input validation. Successful exploitation could enable an attacker to steal an authenticated user's session cookies. Rated MEDIUM with a CVSS score of 5.4, this vulnerability requires user interaction (UI:R) and low privileges (PR:L) for exploitation, but has low impact on confidentiality and integrity (C:L, I:L). While not currently listed in CISA's KEV catalog, its EPSS score is very low, indicating a minimal likelihood of exploitation in the wild. There is no public exploit code available for CVE-2025-40706, nor are there any known Metasploit or Nuclei modules. Community discussion and media coverage are currently absent, suggesting a lack of widespread attention or active exploitation.