Esri vulnerabilities, page 4
195 vulnerabilities
Known vulnerabilities in Esri products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 33 products.
MediumCVE-2025-57876esri · portal_for_arcgisStored XSS vulnerability in Portal for ArcGISThere is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.EPSS0.22%MediumCVE-2025-57873esri · portal_for_arcgisBUG-000175222 - Reflected XSS vulnerability in Portal for ArcGIS.There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.EPSS0.22%MediumCVE-2025-67710esri · arcgis serverStored XSS vulnerability in ArcGIS ServerThere is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.24%MediumCVE-2025-67704esri · arcgis serverStored XSS vulnerability in ArcGIS Server.There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.25%MediumCVE-2025-67703esri · arcgis serverStored XSS vulnerability in ArcGIS Server.There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.24%MediumCVE-2025-67709esri · arcgis serverThere is a cross site scripting issue in ArcGIS Server.There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.24%MediumCVE-2025-67705esri · arcgis serverReflected XSS vulnerability in ArcGIS Server.There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.24%MediumCVE-2025-67706esri · arcgis serverUnvalidated File Upload vulnerability in ArcGIS Server.ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.
However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.
Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.EPSS0.35%MediumCVE-2025-67712esri · arcgis web appbuilder {developer edition)HTML injection issue in ArcGIS Web App BuilderThere is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's browser. There is no evidence of JavaScript execution, which limits the impact. At the time of submission, ArcGIS Web App Builder developer edition is retired and unsupported. ArcGIS Web App Builder 2.30 is not susceptible to this vulnerability.EPSS0.33%MediumCVE-2025-67708esri · arcgis serverReflected cross-site scripting (XSS) vulnerability in ArcGIS Server.There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.24%MediumCVE-2025-67711esri · arcgis serverReflected XSS vulnerability in ArcGIS Server.There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.EPSS0.24%MediumCVE-2025-67707esri · arcgis serverUnvalidated File Upload vulnerability in ArcGIS Server.ArcGIS Server versions 11.5 and earlier on Windows and Linux do not sufficiently validate uploaded files, enabling a remote unauthenticated attacker to upload arbitrary files to the server’s designated upload directories.
However, the server’s architecture enforces controls that restrict uploaded files to non‑executable storage locations and prevent modification or replacement of existing application components or system configurations. Uploaded files cannot be executed, leveraged to escalate privileges, or used to access sensitive data.
Because the issue does not enable execution, service disruption, unauthorized access, or integrity compromise, its impact on confidentiality, integrity, and availability is low. Note that race conditions, secret values, or man‑in‑the‑middle conditions are required for exploitation.EPSS0.30%CriticalCVE-2020-35712esri · arcgis serveresri arcgis serverEsri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.EPSS1.67%MediumCVE-2014-9741esri · arcgis_for_desktop +2 moreesri arcgis_for_desktopMultiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.EPSS1.79%MediumCVE-2014-5121esri · arcgis serveresri arcgis serverMultiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.EPSS2.42%MediumCVE-2014-5122esri · arcgis serveresri arcgis serverOpen redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to login.EPSS2.08%MediumCVE-2005-1393esri · arcinfo_workstationesri arcinfo_workstationMultiple buffer overflows in ArcGIS for ESRI ArcInfo Workstation 9.0 allow local users to execute arbitrary code via long command line arguments to (1) asmaster, (2) asuser, (3) asutility, (4) se, or (5) asrecovery.EPSS0.64%HighCVE-2005-1394esri · arcinfo_workstationesri arcinfo_workstationFormat string vulnerability in ArcGIS for ESRI ArcInfo Workstation 9.0 allows local users to gain privileges via format string specifiers in the ARCHOME environment variable to (1) wservice or (2) lockmgr.EPSS0.83%CriticalCVE-2022-38193esri · portal_for_arcgisCode injection issue in Portal for ArcGIS (10.7.1 and 10.8.1)There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.EPSS0.91%MediumCVE-2022-38189esri · portal_for_arcgisThere is a stored cross-site scripting (XSS) vulnerability in ArcGIS API for JavaScript.A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the user’s browser.EPSS0.60%