VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Dec 31, 2025· Updated Sep 23, 2026

CVE-2025-67705

CVE-2025-67705

Description

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

Affected products

3
  • Esri/Arcgis Servercpe-rescue3 versions
    10.9.1+ 2 more
    • (no CPE)range: 10.9.1
    • (no CPE)range: <=11.4
    • cpe:2.3:a:esri:arcgis_server:*:*:*:*:*:*:*:*range: <=11.5

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.