OrientDB 3.0.17
Approved changes feed: RSS · Atom
cpe:2.3:a:orientdb:orientdb:3.0.17:*:*:*:*:*:*:*part: a version: 3.0.17 update: *
| Vendor | Orientdb (9f8fe2cc-468b-54d2-b696-c000426e9cff) |
|---|---|
| Product | Orientdb (196decf0-0f01-5d6b-b119-842d54a80fca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/orientechnologies/orientdb |
purl2cpe | 2026-06-01 10:16:16.787994 |
pkg:maven/com.orientechnologies/orientdb-parent |
purl2cpe | 2026-06-01 10:16:16.787995 |
pkg:rpm/opensuse/orientdb |
purl2cpe | 2026-06-01 10:16:16.787996 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-25449 |
vulnerable | 2026-06-08 05:13:42.380069 |
OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint
MEDIUM (6.1)
OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute arbitrary JavaScript in users' browsers.
Published: 2026-02-20T22:56:59.691Z
Updated: 2026-05-24T01:36:50.640Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25448 |
vulnerable | 2026-06-08 05:13:42.379729 |
OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation
MEDIUM (6.4)
OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to execute arbitrary scripts when users view the application.
Published: 2026-02-20T22:56:58.789Z
Updated: 2026-04-07T14:04:10.743Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-25447 |
vulnerable | 2026-06-08 05:13:42.379276 |
OrientDB 3.0.17 Cross-Site Request Forgery
MEDIUM (4.3)
OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface.
Published: 2026-02-20T22:56:57.950Z
Updated: 2026-04-07T14:04:10.020Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.