CVE-2025-40649: Bbmri-Eric Negotiator

Medium severity, CVSS 5.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations/<postUID>/posts'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Affected products

• Bbmri-Eric Negotiator: before 3.15.5 (fixed in 3.15.5)

Published 2025-10-07. Last modified 2026-10-08.