Stored Cross-Site Scripting Vulnerability in Esri Portal for ArcGIS Enterprise Sites

CVE-2025-55107

What is CVE-2025-55107?

A stored Cross-site Scripting vulnerability exists in Esri Portal for ArcGIS Enterprise Sites, versions 10.9.1 to 11.4, which enables a remote, authenticated attacker to inject a malicious file with embedded XSS scripts. When the compromised file is accessed, arbitrary JavaScript code could be executed within the victim's browser. This vulnerability could lead to the exposure of sensitive information, including privileged tokens, potentially allowing the attacker to gain unauthorized control over the Portal.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References