CVE-2025-60948

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-60948
Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91 Patch
https://github.com/hx381/cspro-exploits Third Party Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json Broken Link
https://www.cve.org/CVERecord?id=CVE-2025-60948 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:csprousers:csweb:8.0.1:*:*:*:*:*:*:*
History

25 Mar 2026, 21:07

Type Values Removed Values Added
CPE cpe:2.3:a:csprousers:csweb:8.0.1:*:*:*:*:*:*:*
Summary
  • (es) Census CSWeb 8.0.1 permite cross-site scripting almacenado en campos proporcionados por el usuario. Un atacante remoto y autenticado podría almacenar javascript malicioso que se ejecuta en el navegador de una víctima. Corregido en 8.1.0 alpha.
References () https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91 - () https://github.com/csprousers/csweb/commit/eba0b59a243390a1a4f9524cce6dbc0314bf0d91 - Patch
References () https://github.com/hx381/cspro-exploits - () https://github.com/hx381/cspro-exploits - Third Party Advisory
References () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json - () https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-082-01.json - Broken Link
References () https://www.cve.org/CVERecord?id=CVE-2025-60948 - () https://www.cve.org/CVERecord?id=CVE-2025-60948 - Third Party Advisory
First Time Csprousers
Csprousers csweb

23 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-23 22:16

Updated : 2026-03-25 21:07

NVD link : CVE-2025-60948

Mitre link : CVE-2025-60948

CVE.ORG link : CVE-2025-60948

JSON object : View

Products Affected

csprousers

  • csweb
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')