CVE-2019-25367

MEDIUM

ArangoDB Community Edition 3.4.2-1 - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-25367. PoCs published by Ozer Goker.

AI-analyzed exploit summary This exploit demonstrates multiple XSS vulnerabilities in ArangoDB Community Edition 3.4.2-1, including DOM-based, reflected, and stored XSS. The PoC provides specific URLs, payloads, and parameters to trigger the vulnerabilities.

Description

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html) through search, user management, and API parameters. Attackers can inject scripts via parameters in /_db/_system/_admin/aardvark/index.html to execute JavaScript in authenticated users' browsers.

Exploits (1)

exploitdb WORKING POC
by Ozer Goker · textwebappsmultiple
https://www.exploit-db.com/exploits/46407

This exploit demonstrates multiple XSS vulnerabilities in ArangoDB Community Edition 3.4.2-1, including DOM-based, reflected, and stored XSS. The PoC provides specific URLs, payloads, and parameters to trigger the vulnerabilities.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: ArangoDB Community Edition 3.4.2-1
Auth required
Prerequisites: Access to the ArangoDB web interface · Valid credentials for authenticated endpoints
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory exploit
https://www.exploit-db.com/exploits/46407
Various Sources product
https://www.arangodb.com

Scores

CVSS v3 5.4
EPSS 0.0016
EPSS Percentile 6.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
Arangodb/ArangoDB Community Edition 3.4.2-1
Published Feb 15, 2026
Tracked Since Feb 18, 2026