PT-2026-21318 · Orientdb · Orientdb 3.0.17

Ozer Goker · Published 2026-02-20 · Updated 2026-02-24 · CVE-2019-25448

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrientDB version 3.0.17

Description OrientDB 3.0.17 has a stored cross-site scripting issue. Authenticated attackers can inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the /document API endpoint with JavaScript code in the name field, leading to arbitrary script execution when users view the application.

Recommendations Avoid creating users with script payloads in the name parameter. Restrict or sanitize input to the name parameter when creating users. As a temporary workaround, consider disabling user creation functionality until a fix is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25448

Affected Products

Orientdb 3.0.17

References · 6

• 🔥 https://exploit-db.com/exploits/46517 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25448 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25448 · Vendor Advisory
• https://t.me/cveNotify/153011 · Telegram Post
• https://orientdb.dev · Note
• https://vulncheck.com/advisories/orientdb-stored-cross-site-scripting-via-user-creation · Note