Description
There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Esri | ArcGIS Server | 10.9.1 – ≤ 11.4 | — |
Advisories 1
- WID-SEC-2025-2833 ESRI ArcGIS Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 1, 2026