GCVE - cpe:2.3:a:orientdb:orientdb:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:orientdb:orientdb:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Orientdb (`9f8fe2cc-468b-54d2-b696-c000426e9cff`)
Product	Orientdb (`196decf0-0f01-5d6b-b119-842d54a80fca`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/orientechnologies/orientdb`	purl2cpe	2026-06-01 10:16:16.787839
`pkg:maven/com.orientechnologies/orientdb-parent`	purl2cpe	2026-06-01 10:16:16.787842
`pkg:rpm/opensuse/orientdb`	purl2cpe	2026-06-01 10:16:16.787844

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-25449`	vulnerable	2026-06-08 05:13:42.380018	OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint MEDIUM (6.1) OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute arbitrary JavaScript in users' browsers. Published: 2026-02-20T22:56:59.691Z Updated: 2026-05-24T01:36:50.640Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/46517 https://orientdb.dev/ https://www.vulncheck.com/advisories/orientdb-reflected-cross-site-scripting-via-document-endpoint	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25448`	vulnerable	2026-06-08 05:13:42.379663	OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation MEDIUM (6.4) OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to execute arbitrary scripts when users view the application. Published: 2026-02-20T22:56:58.789Z Updated: 2026-04-07T14:04:10.743Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/46517 https://orientdb.dev/ https://www.vulncheck.com/advisories/orientdb-stored-cross-site-scripting-via-user-creation	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25447`	vulnerable	2026-06-08 05:13:42.377739	OrientDB 3.0.17 Cross-Site Request Forgery MEDIUM (4.3) OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface. Published: 2026-02-20T22:56:57.950Z Updated: 2026-04-07T14:04:10.020Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/46517 https://orientdb.dev/ https://www.vulncheck.com/advisories/orientdb-cross-site-request-forgery	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-11467`	vulnerable	2026-06-08 05:08:37.825312	Details available OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request. Published: 2017-07-20T00:00:00.000Z Updated: 2024-08-05T18:12:39.696Z Open on db.gcve.eu Reference links http://www.heavensec.org/?p=1703 https://github.com/orientechnologies/orientdb/wiki/OrientDB-2.2-Release-Notes#2223---july-11-2017	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Orientdb

Notes

PURL mappings

Vulnerability references

Contribute