Census vulnerabilities
Published CVEs affecting Census products: 4 record(s), with severity, exploitation and fixes.
CVE-2025-60949
High · 7.5
CWE-200 Mar 23, 2026
Census CSWeb leaked configuration files
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
CVE-2025-60948
Medium · 5.4
CWE-79 Mar 23, 2026
Census CSWeb stored XSS
Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.
CVE-2025-60947
High · 8.8
CWE-434 Mar 23, 2026
Census CSWeb arbitrary file upload
Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.
CVE-2025-60946
High · 8.8
CWE-22 Mar 23, 2026
Census CSWeb path traversal
Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha.