Vulnerability Database

299,038

Total vulnerabilities in the database

CVE-2023-25840

There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but could potentially render an image in the victims browser.  The privileges required to execute this attack are high.

  • Published: Jul 21, 2023
  • Updated: May 4, 2025
  • CVE: CVE-2023-25840
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 3.4
  • AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
esri / arcgis_server 10.8.1 11.1