Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: arangodb Clear all filters
TI-2019-15420 CVE-2019-25367 · GHSA-2wpq-gf9v-758w

ArangoDB Community Edition 3.4.2-1 XSS via aardvark admin interface

Priority MEDIUM 55

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface (index.html) through search, user management, and API parameters.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00197 Published 2026-02-15 No fix listed CWE-79
TI-2021-07947 CVE-2021-25939 · GHSA-vw3j-xfjf-6rj3

ArangoDB - Blind SSRF when Downloading Foxx Service from URL

Priority LOW 16

In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a feature which allows downloading a Foxx service from a publicly available URL.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.01129 Published 2022-02-09 No fix listed CWE-918
TI-2021-07946 CVE-2021-25938 · GHSA-fm33-4p7j-3jhr

Cross-site scripting in ArangoDB

Priority LOW 29

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named t…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0081 Published 2021-05-24 No fix listed CWE-79