PT-2026-21318 · Orientdb · Orientdb 3.0.17

Ozer Goker · Publicado 2026-02-20 · Atualizado 2026-02-24 · CVE-2019-25448

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrientDB version 3.0.17

Description OrientDB 3.0.17 has a stored cross-site scripting issue. Authenticated attackers can inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the /document API endpoint with JavaScript code in the name field, leading to arbitrary script execution when users view the application.

Recommendations Avoid creating users with script payloads in the name parameter. Restrict or sanitize input to the name parameter when creating users. As a temporary workaround, consider disabling user creation functionality until a fix is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-25448

Produtos afetados

Orientdb 3.0.17

Referências · 6

• 🔥 https://exploit-db.com/exploits/46517 · Exploit
• https://t.me/cveNotify/153011 · Publicação no Telegram
• https://orientdb.dev · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25448 · Nota de Segurança
• https://vulncheck.com/advisories/orientdb-stored-cross-site-scripting-via-user-creation · Nota
• https://osv.dev/vulnerability/CVE-2019-25448 · Aviso do Fabricante