VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Sep 29, 2025· Updated Jun 17, 2026

CVE-2025-57873

CVE-2025-57873

Description

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

Affected products

22
  • Esri/Portal For Arcgisllm-fuzzy22 versions
    <=11.4+ 21 more
    • (no CPE)range: <=11.4
    • (no CPE)range: 10.9.1
    • cpe:2.3:a:esri:portal_for_arcgis:10.9.1:-:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:10.9.1:security_2025_update2:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.0:*:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.1:-:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2024_update2:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.1:security_2025_update2:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.2:-:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2024_update2:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.2:security_2025_update2:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.3:-:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.3:security_2025_update2:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.4:-:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update1:*:*:*:*:*:*
    • cpe:2.3:a:esri:portal_for_arcgis:11.4:security_2025_update2:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.