CVE-2025-55104

BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.

State: Published
Severity: 4.8 Medium
Published: Aug 21, 2025
Updated: Aug 21, 2025
Reserved: Aug 6, 2025

Description

A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create or edit a site to add and store an XSS payload. If this stored XSS payload is triggered by any user attacker supplied JavaScript may execute in the victim's browser.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	Esri

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Portal for ArcGIS Enterprise SitesEsri	10.9.1 through 11.4Affected

References

https://www.esri.com/arcgis-blog/products/trust-arcgis/administration/2925891-2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.