Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 193

Export CSV
CVE-2025-57879

BUG-000171009 - URL manipulation vulnerability in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57878

BUG-000174149 - The Portal for ArcGIS has an unvalidated redirect.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57877

Reflected XSS vulnerability in Portal for ArcGIS.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57876

Stored XSS vulnerability in Portal for ArcGIS

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57875

BUG-000164122 - Reflected XSS vulnerability in Portal for ArcGIS.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57874

BUG-000161627 - Reflected XSS vulnerability in Portal for ArcGIS.  (11.3, 11.1, 10.9.1)

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57873

BUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57872

BUG-000174150 - Unvalidated redirect in Portal for ArcGIS.

There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-57871

BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-55107

BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-55103

BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-55106

BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-55105

BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-55104

BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.

A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2025-1068

There is a code injection vulnerability in Esri ArcGIS AllSource

There is an untrusted search path vulnerability in Esri ArcGIS AllSource 1.2 and 1.3 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS AllSource, the file could execute and run malicious commands under the context of the victim. This issue is corrected in ArcGIS AllSource 1.2.1 and 1.3.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Allsource Arcgis Pro
CVE-2025-1067

There is a code injection vulnerability in ArcGIS Pro

There is an untrusted search path vulnerability in Esri ArcGIS Pro 3.3 and 3.4 that may allow a low privileged attacker with write privileges to the local file system to introduce a malicious executable to the filesystem. When the victim performs a specific action using ArcGIS ArcGIS Pro, the file could execute and run malicious commands under the context of the victim. This issue is addressed in ArcGIS Pro 3.3.3 and 3.4.1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Arcgis Allsource Arcgis Pro
CVE-2021-29098

ArcGIS general raster security update: uninitialized pointer

Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Esri
Products
Arcgis Engine Arcgis Pro Arcmap and 1 more
CVE-2023-25836

BUG-000135364 XSS in 10.8.1 sites builder iframe source

There is a Cross-site Scripting vulnerability in Esri Portal for ArcGIS Sites in versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser.  The privileges required to execute this attack are low.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2023-25831

BUG-000154236 There is a reflected cross-site scripting (XSS) vulnerability in Portal for ArcGIS.

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis
CVE-2023-25830

BUG-000154662 Reflected XSS vulnerability in Portal for ArcGIS

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esri
Products
Portal For Arcgis