CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

82 matches found

OSV•added 2026/06/18 2:28 p.m.•5 views

CVE-2025-52465 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web pa...

7.2CVSS7.2AI score0.58974EPSS

SaveExploits20References6

Positive Technologies•added 2026/06/12 12:0 a.m.•17 views

PT-2026-49053

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.26.4 GeoServer versions prior to 2.27.3 Description An authenticated administrator with access to the security system can provide arbitrary absolute file paths to the Master Password Dump web page to create files...

7.2CVSS8.2AI score0.00353EPSS

SaveExploits0References9

Github Security Blog•added 2026/06/11 8:34 p.m.•16 views

GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

Summary Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution RCE. Impact If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code. Details Authenticated users can access Vector Data Sources page to...

7.2CVSS7.2AI score0.00582EPSS

SaveExploits0References6Affected Software1

Veracode•added 2025/12/13 4:53 a.m.•6 views

XML External Entity (XXE)

GeoServer is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML entity resolution in schema parsing, which allows an attacker to exploit external entity references to access sensitive data or perform unauthorized actions...

9.9CVSS5.3AI score0.52542EPSS

SaveExploits1References9Affected Software2

The Hacker News•added 2025/12/12 5:1 a.m.•21 views

CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 CVSS...

9.8CVSS7.1AI score0.99813EPSS

SaveExploits29

NVD•added 2025/11/25 9:15 p.m.•8 views

CVE-2025-58360

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap...

9.8CVSS0.64874EPSS

SaveExploits4References3

Vulnrichment•added 2025/11/25 8:17 p.m.•6 views

CVE-2025-58360 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

8.2CVSS6.5AI score0.64874EPSS

SaveExploits4References2