PT-2025-39860
CVE-2025-57873
·
Published
2025-09-29
·
Updated
2026-10-09
Description by
CVSS 3.1
4.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Esri Portal for ArcGIS versions 11.4 and below
Description
A reflected cross site scripting issue exists in Esri Portal for ArcGIS. A remote attacker with administrative access can potentially execute arbitrary JavaScript code in a user's browser by supplying a crafted string. The issue involves the potential for injecting malicious scripts through a vulnerable application.
Recommendations
Update Esri Portal for ArcGIS to a version later than 11.4.
Found an issue in the description? Have something to add? Feel free to write us 👾