Craws vulnerabilities
Published CVEs affecting Craws products: 5 record(s), with severity, exploitation and fixes.
CVE-2025-60917
Medium · 4.6
CWE-79 Nov 24, 2025
Cross-site Scripting (XSS) in Craws Openatlas
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter.
CVE-2025-60916
Medium · 5.4
CWE-79 Nov 24, 2025
Cross-site Scripting (XSS) in Craws Openatlas
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.
CVE-2025-60915
High · 8.1
CWE-22 Nov 24, 2025
Path Traversal in Craws Openatlas
An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute a path traversal via a crafted request.
CVE-2025-60914
Medium · 4.6
CWE-79 Nov 24, 2025
Cross-site Scripting (XSS) in Craws Openatlas
Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensitive information via sending a crafted GET request to the /display_logo endpoint.
CVE-2025-56423
Medium · 5.3
CWE-203 Nov 24, 2025
Observable Discrepancy in Craws Openatlas
An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via the login error messages