CVE-2025-50690

A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit 2120adfa17ddd535bd0f539e6c4988fa3a2cb491). The vulnerability is caused by improper handling of user input in the search query parameter. An attacker can craft a specially formed URL with malicious JavaScript code, which is then reflected back and executed in the victim's browser. This flaw allows an attacker to execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, phishing attacks, data theft, or redirection to malicious sites. The issue is exposed on publicly accessible pages, making it exploitable by an unauthenticated attacker.

• CWE-79

• https://github.com/OSGeo/spatialreference.org
• https://medium.com/@Justinsecure/cracking-open-a-reflected-xss-in-spatialreference-org-fcc42175ae6b

Published

Aug 13, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50674An issue was discovered in the changePassword method in file…7.8
• CVE-2025-50675GPMAW 14, a bioinformatics software, has a critical vulnerab…7.8
• CVE-2025-5068Use after free in Blink in Google Chrome prior to 137.0.7151…8.8
• CVE-2025-50681igmpproxy 0.4 before commit 2b30c36 allows remote attackers …7.5
• CVE-2025-50688A command injection vulnerability exists in TwistedWeb (vers…6.5
• CVE-2025-5069An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2025-50691MCSManager 10.5.3 daemon process runs as a root account by d…5.3
• CVE-2025-50692FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/tem…9.8
• CVE-2025-50693PHPGurukul Online DJ Booking Management System 2.0 is vulner…6.5
• CVE-2025-50695PHPGurukul Online DJ Booking Management System 2.0 is vulner…6.1
• CVE-2025-50699PHPGurukul Online DJ Booking Management System 2.0 is vulner…6.1
• CVE-2025-50706An issue in thinkphp v.5.1 allows a remote attacker to execu…9.8