GeoTools jsonArrayContains() Disclosure Code Execution

The vulnerability of the jsonArrayContains function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, is related to the lack of protective measures for the SQL query structure during the processing of the CQLFILTER parameter...

Exploit for CVE-2026-76904

GeoServer SQL Injection to RCE Zero-Day CVE: CVE-2026...

geoserver-0day-rce

GeoServer SQL Injection to RCE Zero-Day CVE: None yet?...

GHSA-3GMF-P6R4-Q8M6 vulnerabilities

Vulnerabilities for packages: geoserver...

CVE-2026-43975 vulnerabilities

Vulnerabilities for packages: geoserver...

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution RCE. The security defect remain...

PT-2026-78872

Уязвимость функции jsonArrayContains библиотеки GeoTools программного обеспечения для администрирования и публикации геоданных на сервере OSGeo GeoServer связана с непринятием мер по защите структуры SQL-запроса при обработке параметра CQL FILTER. Эксплуатация уязвимости может позволить нарушител...

GHSA-JRV5-8W28-4265 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, camunda-zeebe, geoserver, kafbat-ui...

CVE-2026-41720 vulnerabilities

Vulnerabilities for packages: kafbat-ui-fips, camunda-zeebe, geoserver, kafbat-ui...

GeoServer <1.2.2 - Remote Code Execution Detection

Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22...

Geoserver - Server-Side Request Forgery Detection

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer through 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

GeoServer - Missing Authorization on REST API Index Detection

GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer contains a missing authorization vulnerability that allows...

GeoServer Login Panel - Detect

GeoServer login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GeoServer Login Panel - Detect', 'description':...

CVE-2026-54291 vulnerabilities

Vulnerabilities for packages: geoserver, airbyte-server-fips, sonarqube, conductor-fips, request-9047-keycloak-fips, floci, keycloak, apicurio-registry-fips, flyway-fips, traccar-fips, druid, debezium, thingsboard, conductor, keycloak-fips, apicurio-registry, apache-hop-fips, nacos, kayenta,...

GHSA-J92G-9F8W-J867 vulnerabilities

Vulnerabilities for packages: geoserver, airbyte-server-fips, sonarqube, conductor-fips, request-9047-keycloak-fips, floci, keycloak, apicurio-registry-fips, flyway-fips, traccar-fips, druid, debezium, thingsboard, conductor, keycloak-fips, apicurio-registry, apache-hop-fips, nacos, kayenta,...

Exploit for SQL Injection in Osgeo Geoserver

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-...

OSGeo GeoServer writeMasterPasswordInfo Code Execution Sensitive Information

The vulnerability of the writeMasterPasswordInfo method in the software for managing and publishing geodata on the OSGeo GeoServer server is related to improper external management of file names or paths. Exploiting this vulnerability could allow an attacker to execute arbitrary code, disclose...

New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks

A newly discovered cyber attack campaign has been observed delivering a previously undocumented malware family called SharkLoader that acts as a loader for deploying Cobalt Strike Beacon on compromised hosts. Kaspersky, which is tracking the activity under the moniker StrikeShark , said the...

CVE-2025-52465

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web pa...

CVE-2025-58175

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses ENTITYRESOLUTIONALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery SSRF. This vulnerability requires that GeoServer i...