XSS in Esri Arcgis Web Appbuilder {Developer Edition)
CVE-2025-67712
There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to potentially entice a user to click a link that causes arbitrary HTML to render in a victim's browser. There is no evidence of JavaScript execution, which limits the impact. At the time of submission, ArcGIS Web App Builder developer edition is retired and unsupported. ArcGIS Web App Builder 2.30 is not susceptible to this vulnerability.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.003 (20.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N.
Affected products
- Esri Arcgis Web Appbuilder {Developer Edition) — versions all
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-67712?
- CVE-2025-67712 is a medium-severity vulnerability in Esri Arcgis Web Appbuilder {Developer Edition), classified under Cross-site Scripting. CVSS score: 4.7/10. Published 2025-12-19.
- How severe is CVE-2025-67712?
- Medium severity. CVSS v3 base score is 4.7 out of 10.