CVE-2025-67703

Medium · 6.1

CVSS

6.1

EPSS

0.2%

Published

Dec 31, 2025

CISA due date

—

The record

There is a stored cross site scripting issue in Esri ArcGIS Server 11.4 and earlier on Windows and Linux that in some configurations allows a remote unauthenticated attacker to store files that contain malicious code that may execute in the context of a victim’s browser.

Affected packages

Ecosystem	Package	Introduced	Fixed