# Esri Arcgis Server


- [CVE-2025-57870](https://insights.sbomify.com/CVE-2025-57870/): BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services. (critical 10.0)
- [CVE-2026-9181](https://insights.sbomify.com/CVE-2026-9181/): Directory Traversal in ArcGIS Server (critical 9.8)
- [CVE-2026-9182](https://insights.sbomify.com/CVE-2026-9182/): Unvalidated File Upload vulnerability in ArcGIS Server. (critical 9.8)
- [CVE-2020-35712](https://insights.sbomify.com/CVE-2020-35712/): Server-side request forgery in n/a (critical 9.8)
- [CVE-2021-29102](https://insights.sbomify.com/CVE-2021-29102/): There is a Server-Side Request Forgery (SSRF) vulnerability in Esri ArcGIS Server Manager version 10.8.1 and below. (critical 9.1)
- [CVE-2024-51962](https://insights.sbomify.com/CVE-2024-51962/): SQL injection vulnerability in ArcGIS Server (high 8.7)
- [CVE-2024-51954](https://insights.sbomify.com/CVE-2024-51954/): Unauthorized access to secure services in ArcGIS Server (high 8.5)
- [CVE-2024-51961](https://insights.sbomify.com/CVE-2024-51961/): Local file inclusion (LFI) vulnerability in ArcGIS Server (high 7.5)
- [CVE-2022-38202](https://insights.sbomify.com/CVE-2022-38202/): BUG-000152121 - Directory traversal vulnerability in ArcGIS Server. (high 7.5)
- [CVE-2013-7232](https://insights.sbomify.com/CVE-2013-7232/): SQL injection in n/a (high 7.5)
- [CVE-2021-29114](https://insights.sbomify.com/CVE-2021-29114/): SQL injection vulnerability in ArcGIS Server (high 7.3)
- [CVE-2022-38196](https://insights.sbomify.com/CVE-2022-38196/): BUG-000150537 - ArcGIS Server has a local file inclusion (LFI) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/products/esri/arcgis-server/