Skip to content
OpenAdvisories
Medium WID-SEC-2025-1760 5 CVEs

ESRI ArcGIS Enterprise Sites: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Published Aug 11, 2025 · Updated Aug 11, 2025 · de-DE

Vendor: Esri Product: ArcGIS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in ESRI ArcGIS Enterprise Sites ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

ArcGIS ist ein Geoinformationssystem.

Vulnerabilities 5

  • Medium 4.8
    CVE-2025-55103

    BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

    There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially e…

    Esri Portal for ArcGIS Enterprise Sites
  • Medium 4.8
    CVE-2025-55104

    BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.

    A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user a…

    Esri Portal for ArcGIS Enterprise Sites
  • Medium 4.8
    CVE-2025-55105

    BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

    There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially e…

    Esri Portal for ArcGIS Enterprise Experience Sites
  • Medium 4.8
    CVE-2025-55106

    BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.

    There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially e…

    Esri Portal for ArcGIS Enterprise Sites
  • Medium 4.8
    CVE-2025-55107

    BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.

    There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially e…

    Esri Portal for ArcGIS Enterprise Sites

Revision history

  1. #1

    Initiale Fassung

References