Vulnerability Database

298,930

Total vulnerabilities in the database

CVE-2025-57870

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.

  • Published: Oct 22, 2025
  • Updated: Nov 4, 2025
  • CVE: CVE-2025-57870
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 10
  • AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWEs:

OWASP TOP 10:

Software From Fixed in
esri / arcgis_server 11.3 11.5.x