CVE-2019-25447: Orientdb

Low severity, CVSS 3.5. EPSS: 0.1% chance of exploitation in the next 30 days.

OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface.

Affected products

• Orientdb Orientdb: version 3.0.17 only

Published 2026-02-20. Last modified 2026-06-17.