PT-2026-21319 · Orientdb · Orientdb

Ozer Goker · Published 2026-02-20 · Updated 2026-02-24 · CVE-2019-25449

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrientDB version 3.0.17

Description The software contains a reflected cross-site scripting issue that allows attackers to inject malicious scripts. Attackers can send POST requests to the ''/document/demodb/-1:-1'' API endpoint with script tags in the name parameter to execute arbitrary JavaScript in users' browsers. The attack involves submitting crafted JSON payloads to the document endpoint.

Recommendations Apply input validation and sanitization to the name parameter in the ''/document/demodb/-1:-1'' API endpoint to prevent the injection of script tags.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25449

Affected Products

Orientdb

References · 6

• 🔥 https://exploit-db.com/exploits/46517 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25449 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25449 · Vendor Advisory
• https://vulncheck.com/advisories/orientdb-reflected-cross-site-scripting-via-document-endpoint · Note
• https://t.me/cveNotify/153012 · Telegram Post
• https://orientdb.dev · Note