Arcgis Server
Monthly
Denial of service in Esri ArcGIS Server 12.0 and earlier can occur when crafted requests exhaust all available worker threads, denying service to legitimate users. The issue is remotely reachable without authentication or user interaction, but Esri describes the thread exhaustion as occurring only under exceptional circumstances and does not specify the exact trigger. Patches are available for the General Availability and Extended support branches 12.0, 11.5, 11.3, and 11.1; no public exploit was identified at time of analysis.
SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux allows remote attackers to invoke database-specific functions that should not be permitted, with high confidentiality, integrity, and availability impact. In default deployments the attacker must hold privileges to access the targeted service; fully anonymous exploitation is possible only when a service is explicitly configured in the non-default 'public' access mode, so realistic exposure is lower than the input 9.8 base score suggests. The vendor has released patches for 12.1, 12.0, 11.5, 11.3, and 11.1, and no public exploit is identified in the supplied data.
Unauthenticated file disclosure in Esri ArcGIS Server (all versions 12.0 and prior) lets remote attackers read sensitive files by supplying crafted path parameters that escape the intended directory. The flaw is network-reachable with no authentication or user interaction and, per CISA's SSVC framework, is automatable with total technical impact, though no public exploit has been identified and EPSS exploitation probability remains modest at 0.72%. Esri disclosed and patched the issue in its May 2026 ArcGIS security bulletin.
Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push arbitrary files to an exposed administrative/upload endpoint, per CVSS PR:N. Esri self-reported the flaw (CWE-434) and rates it critical (CVSS 9.8), and successful upload of an executable payload can lead to full server compromise. There is no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile), indicating it is not yet a mass-exploitation target.
Reflected cross-site scripting in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, executes arbitrary JavaScript in that victim's browser context. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79), the flaw requires victim interaction - the attacker-supplied link must actually be clicked - and the resulting impact is confined to the low-privilege browser session rather than server-side compromise. There is no CISA KEV entry and no public exploit identified at time of analysis; Esri rates the issue as a this-month priority rather than an emergency, reflecting a genuine but non-urgent patching task for administrators running the affected Portal versions.
Stored cross-site scripting in Esri ArcGIS Server 11.1 and earlier on Windows and Linux lets a remote unauthenticated attacker in certain susceptible configurations store files containing malicious code that then executes in a victim's browser when that content is loaded, requiring victim interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C). Impact is confined to the victim's browser session rather than the server itself, and exploitation depends on a non-default or specific configuration whose exact upload path or enabling setting is not described in available sources. No public exploit code or confirmed active exploitation is identified, and the vendor has issued patches in the October 2026 ArcGIS security bulletin for the 12.1, 12.0, 11.5, 11.3, and 11.1 branches.
Service metadata tampering in Esri ArcGIS Server 11.3 through 12.0 allows a remote, unauthenticated attacker with network reachability to update service metadata without user interaction, affecting integrity only (CVSS 5.3). The vendor restricts the affected window to 11.3-12.0 and provides patches for 12.0, 11.5, and 11.3; no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate, this-month remediation priority rather than an emergency.
Reflected cross-site scripting (CWE-79) in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, can execute arbitrary JavaScript in that victim's browser context. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N): the attack is network-delivered and requires no attacker credentials, but success depends entirely on user interaction, and impact is bounded by a scope change with low confidentiality and integrity effects and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Esri has published a patched ArcGIS Server 11.5 line for versions in General Availability and Extended support.
Open redirect vulnerability in ArcGIS Server 11.5 allows an attacker to craft a malicious login-workflow URL that, upon user authentication, silently redirects the victim's browser to an attacker-controlled external site. The flaw lies in insufficient input validation of the redirect parameter within the login redirection workflow, with impact explicitly limited to client-side browser navigation - no server-side compromise or cross-component data exposure is possible. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified at time of analysis, and EPSS data was not present in the available intelligence feed.
Improper authentication on an undocumented administrative endpoint in ArcGIS Server 11.1 through 12.0 allows unauthenticated remote attackers to disrupt the web-based browsing interface by sending a crafted HTTP request. The vulnerability is classified as CWE-287 and carries a CVSS 5.3 medium score, reflecting network-reachable, zero-privilege exploitation offset by limited impact (integrity only, no confidentiality or availability loss). No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to persist files containing malicious script that later executes in the browser context of a victim user who loads the affected content. The vulnerability carries a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that no credentials are needed to store the payload but that successful execution depends on victim interaction and the deployment being one of the specific vulnerable configurations referenced by the vendor rather than every installation. Per available intelligence there is no confirmation of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, so this is a genuine but moderate-priority issue rather than an over-scored critical; a vendor patch is available.
Stored cross-site scripting (XSS) in Esri ArcGIS Server 11.4 and earlier allows remote unauthenticated attackers to store malicious content that executes in a victim's browser, but exploitation requires the victim to view the stored content (UI:R) and a specific non-default vulnerable configuration. No public exploit identified at time of analysis. A vendor patch (Security 2025 Update 2) is available.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to store files containing malicious code that executes in a victim's browser when loaded. Exploitation requires specific non-default configurations and victim interaction, limiting real-world risk; no public exploit code or active exploitation has been identified at time of analysis. The vulnerability is rated CVSS 6.1 (Medium).
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows remote unauthenticated attackers to persist files containing malicious script that later executes in the browser of a victim who opens the stored content, yielding script execution in the victim's browser context rather than on the server. The issue is scoped by the vendor to 'some configurations,' so default or hardened deployments may not expose the unauthenticated file-storage path, and exploitation requires victim interaction (UI:R) - a legitimate user must subsequently view the attacker-supplied content for the payload to fire. Impact is limited to Low confidentiality and Low integrity with no availability effect (CVSS 3.1 6.1, scope-changed), there is no public exploit identified at time of analysis, and a vendor patch is available per the Esri Trust ArcGIS advisory, making this a legitimate but moderate-severity issue rather than a top-tier emergency.
ArcGIS Server versions 11.5 and earlier on Windows and Linux are affected by an unrestricted file upload vulnerability (CWE-434) that allows unauthenticated, network-based attackers to upload arbitrary files, but architectural controls confine uploads to non-executable directories, preventing code execution, privilege escalation, or sensitive data access. Exploitation is further complicated by high attack complexity (AC:H), requiring a race condition, secret value, or man-in-the-middle position, and yields only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and a vendor patch is available.
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux lets a remote, unauthenticated attacker persist malicious script through a server endpoint that later executes in the browser context of any user or administrator who loads the poisoned content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium, CWE-79). Exploitation is not universal: it depends on the unspecified 'some configurations' the vendor references and is gated on victim interaction (UI:R), so impact is limited to client-side script execution in the victim's browser session rather than server compromise. Patch available per vendor advisory in the ArcGIS Server Security 2025 Update 2 Patch; no public exploit code was identified at time of analysis.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to plant files containing malicious code that later executes in a victim's browser when the affected page is viewed. Exploitation is limited to instances running in one of the affected non-default configurations and requires victim interaction (the user must load the page hosting the stored payload), so the impact is confined to the victim's browser session (scope change) rather than direct server compromise, giving a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE as confirmed actively exploited.
Stored cross-site scripting (CWE-79) in Esri ArcGIS Server 11.4 and earlier on Windows and Linux enables a remote unauthenticated attacker (PR:N) to store files containing malicious code that executes in a victim's browser when the stored content is viewed (UI:R), but only in certain non-default configurations according to the vendor. The impact is limited to the victim's browser context (C:L/I:L, no availability impact), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Esri has released a patch referenced in the ArcGIS Server Security 2025 Update 2 advisory.
Unauthenticated SQL injection in Esri ArcGIS Server 11.3, 11.4, and 11.5 (Windows, Linux, Kubernetes) lets a remote attacker run arbitrary SQL through one specific ArcGIS Feature Service operation, with the potential to read, alter, or delete data in the underlying Enterprise Geodatabase. With CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), no authentication, no user interaction, and no non-default configuration are required beyond the server publishing Feature Services, which is a standard ArcGIS Server use case, so the practical exposure hinges mainly on whether the server is reachable - network-isolated or unpublished servers and hosts already on a patched build are not affected. There is confirmed actively exploited status is not indicated by the inputs; no public exploit code identified at time of analysis and no CISA KEV listing was provided, though the scope change (S:C) reflects that compromise of the web tier extends into the backend spatial database.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in Esri ArcGIS Server 12.0 and earlier can occur when crafted requests exhaust all available worker threads, denying service to legitimate users. The issue is remotely reachable without authentication or user interaction, but Esri describes the thread exhaustion as occurring only under exceptional circumstances and does not specify the exact trigger. Patches are available for the General Availability and Extended support branches 12.0, 11.5, 11.3, and 11.1; no public exploit was identified at time of analysis.
SQL injection in Esri ArcGIS Server 12.1 and earlier on Windows and Linux allows remote attackers to invoke database-specific functions that should not be permitted, with high confidentiality, integrity, and availability impact. In default deployments the attacker must hold privileges to access the targeted service; fully anonymous exploitation is possible only when a service is explicitly configured in the non-default 'public' access mode, so realistic exposure is lower than the input 9.8 base score suggests. The vendor has released patches for 12.1, 12.0, 11.5, 11.3, and 11.1, and no public exploit is identified in the supplied data.
Unauthenticated file disclosure in Esri ArcGIS Server (all versions 12.0 and prior) lets remote attackers read sensitive files by supplying crafted path parameters that escape the intended directory. The flaw is network-reachable with no authentication or user interaction and, per CISA's SSVC framework, is automatable with total technical impact, though no public exploit has been identified and EPSS exploitation probability remains modest at 0.72%. Esri disclosed and patched the issue in its May 2026 ArcGIS security bulletin.
Unrestricted file upload in Esri ArcGIS Server (all versions through 12.0) lets a remote, unauthenticated attacker push arbitrary files to an exposed administrative/upload endpoint, per CVSS PR:N. Esri self-reported the flaw (CWE-434) and rates it critical (CVSS 9.8), and successful upload of an executable payload can lead to full server compromise. There is no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile), indicating it is not yet a mass-exploitation target.
Reflected cross-site scripting in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, executes arbitrary JavaScript in that victim's browser context. Rated CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79), the flaw requires victim interaction - the attacker-supplied link must actually be clicked - and the resulting impact is confined to the low-privilege browser session rather than server-side compromise. There is no CISA KEV entry and no public exploit identified at time of analysis; Esri rates the issue as a this-month priority rather than an emergency, reflecting a genuine but non-urgent patching task for administrators running the affected Portal versions.
Stored cross-site scripting in Esri ArcGIS Server 11.1 and earlier on Windows and Linux lets a remote unauthenticated attacker in certain susceptible configurations store files containing malicious code that then executes in a victim's browser when that content is loaded, requiring victim interaction (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C). Impact is confined to the victim's browser session rather than the server itself, and exploitation depends on a non-default or specific configuration whose exact upload path or enabling setting is not described in available sources. No public exploit code or confirmed active exploitation is identified, and the vendor has issued patches in the October 2026 ArcGIS security bulletin for the 12.1, 12.0, 11.5, 11.3, and 11.1 branches.
Service metadata tampering in Esri ArcGIS Server 11.3 through 12.0 allows a remote, unauthenticated attacker with network reachability to update service metadata without user interaction, affecting integrity only (CVSS 5.3). The vendor restricts the affected window to 11.3-12.0 and provides patches for 12.0, 11.5, and 11.3; no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate, this-month remediation priority rather than an emergency.
Reflected cross-site scripting (CWE-79) in Esri Portal for ArcGIS 12.1 and earlier allows a remote, unauthenticated attacker to craft a link that, when clicked by a victim, can execute arbitrary JavaScript in that victim's browser context. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N): the attack is network-delivered and requires no attacker credentials, but success depends entirely on user interaction, and impact is bounded by a scope change with low confidentiality and integrity effects and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and Esri has published a patched ArcGIS Server 11.5 line for versions in General Availability and Extended support.
Open redirect vulnerability in ArcGIS Server 11.5 allows an attacker to craft a malicious login-workflow URL that, upon user authentication, silently redirects the victim's browser to an attacker-controlled external site. The flaw lies in insufficient input validation of the redirect parameter within the login redirection workflow, with impact explicitly limited to client-side browser navigation - no server-side compromise or cross-component data exposure is possible. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified at time of analysis, and EPSS data was not present in the available intelligence feed.
Improper authentication on an undocumented administrative endpoint in ArcGIS Server 11.1 through 12.0 allows unauthenticated remote attackers to disrupt the web-based browsing interface by sending a crafted HTTP request. The vulnerability is classified as CWE-287 and carries a CVSS 5.3 medium score, reflecting network-reachable, zero-privilege exploitation offset by limited impact (integrity only, no confidentiality or availability loss). No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to persist files containing malicious script that later executes in the browser context of a victim user who loads the affected content. The vulnerability carries a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that no credentials are needed to store the payload but that successful execution depends on victim interaction and the deployment being one of the specific vulnerable configurations referenced by the vendor rather than every installation. Per available intelligence there is no confirmation of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, so this is a genuine but moderate-priority issue rather than an over-scored critical; a vendor patch is available.
Stored cross-site scripting (XSS) in Esri ArcGIS Server 11.4 and earlier allows remote unauthenticated attackers to store malicious content that executes in a victim's browser, but exploitation requires the victim to view the stored content (UI:R) and a specific non-default vulnerable configuration. No public exploit identified at time of analysis. A vendor patch (Security 2025 Update 2) is available.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to store files containing malicious code that executes in a victim's browser when loaded. Exploitation requires specific non-default configurations and victim interaction, limiting real-world risk; no public exploit code or active exploitation has been identified at time of analysis. The vulnerability is rated CVSS 6.1 (Medium).
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows remote unauthenticated attackers to persist files containing malicious script that later executes in the browser of a victim who opens the stored content, yielding script execution in the victim's browser context rather than on the server. The issue is scoped by the vendor to 'some configurations,' so default or hardened deployments may not expose the unauthenticated file-storage path, and exploitation requires victim interaction (UI:R) - a legitimate user must subsequently view the attacker-supplied content for the payload to fire. Impact is limited to Low confidentiality and Low integrity with no availability effect (CVSS 3.1 6.1, scope-changed), there is no public exploit identified at time of analysis, and a vendor patch is available per the Esri Trust ArcGIS advisory, making this a legitimate but moderate-severity issue rather than a top-tier emergency.
ArcGIS Server versions 11.5 and earlier on Windows and Linux are affected by an unrestricted file upload vulnerability (CWE-434) that allows unauthenticated, network-based attackers to upload arbitrary files, but architectural controls confine uploads to non-executable directories, preventing code execution, privilege escalation, or sensitive data access. Exploitation is further complicated by high attack complexity (AC:H), requiring a race condition, secret value, or man-in-the-middle position, and yields only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and a vendor patch is available.
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux lets a remote, unauthenticated attacker persist malicious script through a server endpoint that later executes in the browser context of any user or administrator who loads the poisoned content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 Medium, CWE-79). Exploitation is not universal: it depends on the unspecified 'some configurations' the vendor references and is gated on victim interaction (UI:R), so impact is limited to client-side script execution in the victim's browser session rather than server compromise. Patch available per vendor advisory in the ArcGIS Server Security 2025 Update 2 Patch; no public exploit code was identified at time of analysis.
Stored cross-site scripting in Esri ArcGIS Server 11.4 and earlier on Windows and Linux allows a remote unauthenticated attacker to plant files containing malicious code that later executes in a victim's browser when the affected page is viewed. Exploitation is limited to instances running in one of the affected non-default configurations and requires victim interaction (the user must load the page hosting the stored payload), so the impact is confined to the victim's browser session (scope change) rather than direct server compromise, giving a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE as confirmed actively exploited.
Stored cross-site scripting (CWE-79) in Esri ArcGIS Server 11.4 and earlier on Windows and Linux enables a remote unauthenticated attacker (PR:N) to store files containing malicious code that executes in a victim's browser when the stored content is viewed (UI:R), but only in certain non-default configurations according to the vendor. The impact is limited to the victim's browser context (C:L/I:L, no availability impact), and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis. Esri has released a patch referenced in the ArcGIS Server Security 2025 Update 2 advisory.
Unauthenticated SQL injection in Esri ArcGIS Server 11.3, 11.4, and 11.5 (Windows, Linux, Kubernetes) lets a remote attacker run arbitrary SQL through one specific ArcGIS Feature Service operation, with the potential to read, alter, or delete data in the underlying Enterprise Geodatabase. With CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), no authentication, no user interaction, and no non-default configuration are required beyond the server publishing Feature Services, which is a standard ArcGIS Server use case, so the practical exposure hinges mainly on whether the server is reachable - network-isolated or unpublished servers and hosts already on a patched build are not affected. There is confirmed actively exploited status is not indicated by the inputs; no public exploit code identified at time of analysis and no CISA KEV listing was provided, though the scope change (S:C) reflects that compromise of the web tier extends into the backend spatial database.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and follow that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A SQL injection vulnerability in ArcGIS Server allows an EDIT operation to modify column properties in a manner that could lead to SQL injection when performed by a remote authenticated user. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a local file inclusion vulnerability in ArcGIS Server 11.3 and below that may allow a remote, unauthenticated attacker to craft a URL that could potentially disclose sensitive configuration. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in ESRI ArcGIS Server versions 11.3 and below. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is an improper access control issue in ArcGIS Server versions 11.3 and below on Windows and Linux which, under unique circumstances, could allow a remote, low‑privileged authenticated attacker. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
ArcGIS Enterprise Server versions 11.0 and below have an information disclosure vulnerability where a remote, unauthorized attacker may submit a crafted query that may result in a low severity. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
There is a Cross-site Scripting vulnerability in ArcGIS Server in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which onmouseover wont execute but. Rated low severity (CVSS 3.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only) feature services may allow a remote, unauthenticated attacker to pass and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attacker to inject attacker supplied html into a page. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple uninitialized pointer vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple buffer overflow vulnerabilities when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A use-after-free vulnerability when parsing a specially crafted file in Esri ArcGIS Server 10.8.1 (and earlier) allows an authenticated attacker with specialized permissions to achieve arbitrary code. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
Open redirect vulnerability in ESRI ArcGIS for Server 10.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter, related to. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.
The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
SQL injection vulnerability in ESRI ArcGIS 10.1 allows remote authenticated users to execute arbitrary SQL commands via the where parameter to a query URI for a REST service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.