Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
28 results
Aug 21, 2025There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticateCVE-2025-55107 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- Portal for ArcGIS Enterprise Sites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated atCVE-2025-55106 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- Portal for ArcGIS Enterprise Sites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated atCVE-2025-55105 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- Portal for ArcGIS Enterprise Experience Sites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create orCVE-2025-55104 · Other software · Esri · reported by psirt@esri.comMedium 4.8
A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.
- Product
- Portal for ArcGIS Enterprise Sites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated atCVE-2025-55103 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated attacker to inject malicious a file with an embedded xss script which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- Portal for ArcGIS Enterprise Sites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafteCVE-2024-38036 · Other software · Esri · reported by psirt@esri.comMedium 5.4
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- Portal for ArcGIS Enterprise Experience Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated aCVE-2024-25702 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- ArcGIS Enterprise Web App Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, auCVE-2024-25701 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Experience Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Experience Builder Embed widget which when loaded could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- Portal for ArcGIS Enterprise Experience Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2024There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attackeCVE-2024-25694 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the Layer Showcase application configuration which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high. The attack could disclose a privileged token which may result in the attacker gaining full control of the Portal.
- Product
- Enterprise Web App Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, autCVE-2024-25708 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high.
- Product
- ArcGIS Enterprise Web App Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, autheCVE-2024-25700 · Other software · Esri · reported by psirt@esri.comMedium 4.8
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in a web map link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required to execute this attack are high.
- Product
- ArcGIS Enterprise Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a craftedCVE-2024-25690 · Other software · Esri · reported by psirt@esri.comMedium 4.7
There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.
- Product
- ArcGIS Enterprise Web App Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2023ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query tCVE-2023-25848 · Other software · Esri · reported by psirt@esri.comMedium 5.3
ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity information disclosure issue. The information disclosed is limited to a single attribute in a database connection string. No business data is disclosed.
- Product
- ArcGIS Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unautCVE-2023-25841 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. Mitigation: Disable anonymous access to ArcGIS Feature services with edit capabilities.
- Product
- ArcGIS Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted liCVE-2023-25840 · Other software · Esri · reported by psirt@esri.comLow 3.4
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser. The privileges required to execute this attack are high.
- Product
- ArcGIS Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2023There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to cCVE-2023-25837 · Other software · Esri · reported by psirt@esri.comHigh 8.4
There is a Cross‑Site Scripting (XSS) vulnerability in Esri ArcGIS Enterprise Sites versions 10.9 and below that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could result in the execution of arbitrary JavaScript code in the target’s browser. Exploitation requires high‑privileged authenticated access. Successful exploitation may allow the attacker to access sensitive session data, manipulate trusted content, and disrupt normal application functionality, resulting in a high impact to confidentiality, integrity, and availability.
- Product
- Portal for ArcGIS Sites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2023 There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitraryCVE-2023-25838 · Other software · Esri · reported by psirt@esri.comHigh 7.5
There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex and requires significant effort before a successful attack can be expected.
- Product
- ArcGIS Insights
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and CVE-2022-38212 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and CVE-2022-38211 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to creatCVE-2022-38210 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that coulCVE-2022-38208 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create CVE-2022-38207 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked which could execute arbitrary JavaScript code in the victim’s browser.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create aCVE-2022-38206 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victim’s browser.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker CVE-2022-38205 · Other software · Esri · reported by psirt@esri.comHigh 8.6
In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published content).
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a craftCVE-2022-38204 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to viewCVE-2021-29115 · Other software · Esri · reported by psirt@esri.comMedium 5.3
An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and below may allows a remote attacker to view hidden field names in feature layers. This issue may reveal field names, but not not disclose features.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2021A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrarCVE-2021-3012 · Other software · Esri · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror (in the URL field of the Parameters tab).
- Product
- Arcgis Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.bssi.frblog.bssi.fr
Sep 11, 2019In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.CVE-2019-16193 · Other software · Esri · reported by MITREMedium 5.4
In ArcGIS Enterprise 10.6.1, a crafted IFRAME element can be used to trigger a Cross Frame Scripting (XFS) attack through the EDIT MY PROFILE feature.
- Product
- Arcgis Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.