CVE-2019-25449 OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint

What is CVE-2019-25449?

CVE-2019-25449 is a medium-severity cross-site scripting vulnerability in OrientDB, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute arbitrary JavaScript in users' browsers.

Weakness: CWE-79

Which versions are affected by CVE-2019-25449?

It affects 1 product.

Products include Orientdb Orientdb.

How do I fix CVE-2019-25449?

No fix has been published for CVE-2019-25449 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-25449 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25449 exists.

Other vulnerabilities in OrientDB

• CVE-2017-11467 OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection Critical 9.8
• CVE-2015-2912 OrientDB-Server vulnerable to Cross-Site Request Forgery High 8.8
• CVE-2015-2918 OrientDB Studio web management interface is vulnerable to clickjacking attacks Medium 6.1
• CVE-2015-2913 OrientDB Server Community Edition uses insufficiently random values to generate session IDs Medium 5.9
• CVE-2019-25447 OrientDB 3.0.17 Cross-Site Request Forgery Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8pcr-7mgm-xjqp.