CVE-2019-25449 MEDIUM

CVE-2019-25449: OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint

Vendor Orientdb

Product OrientDB

Weakness CWE-79 · XSS

Published February 20, 2026

Last update May 24, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute arbitrary JavaScript in users' browsers.

Key dates

02Disclosure timeline

February 20, 2026 CVE published

May 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25449 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-45452 WordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-23349 Apache Answer: XSS vulnerability when submitting summary CVE-2024-37922 WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerability CVE-2024-9270 Lenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2025-64605 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)