What’s Vulnerable › Vulnerabilities

CVE-2019-25367: ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-15 · updated 2026-06-17
• Weakness: CWE-79

Description

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html) through search, user management, and API parameters. Attackers can inject scripts via parameters in /_db/_system/_admin/aardvark/index.html to execute JavaScript in authenticated users' browsers.

Affected products

• ArangoDB Community Edition: 3.4.2-1

References

• https://www.arangodb.com
• https://www.exploit-db.com/exploits/46407
• https://www.vulncheck.com/advisories/arangodb-community-edition-xss-via-aardvark-admin

Get alerted when CVE-2019-25367 or the next vulnerability affects your stack