98 matches found
CVE-2024-36401-GeoServer-RCE
RCE vulnerability in GeoServer CVE-2024-36401 - detection script CVE-2024-36401 is a critical security vulnerability affecting GeoServer, an open-source server for sharing geospatial data, and GeoTools, an open-source Java library that provides tools for geospatial data. The vulnerability,...
CVE-2023-25157-and-CVE-2023-25158
Inyección SQL en GeoServer y GeoTools CVE-2023-25157 y CVE-2023-25158 Este repositorio contiene una descripción detallada y los pasos de replicación de las vulnerabilidades de inyección SQL encontradas en la plataforma GeoServer y en la librería GeoTools. A la vulnerabilidad se le han asignado lo...
CVE-2022-24818
CVE-2022-24818: Java Deserialization via Unchecked JNDI Lookups in GeoServer and GeoTools The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. As an example thi...
GeoServer and GeoTools - Remote Code Execution
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution RCE is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6...
CVE-2023-25157
Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...
CVE-2023-25157-GeoServer-SQLi-Lab
GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Vulnerability Lab & PoC Report Practical environment Vulnerable Lab and detailed exploitation analysis report for SQL Injection Error-based vulnerability in GeoServer CVE-2023-25157 and the GeoTools library CVE-2023-25158...
Exploit for SQL Injection in Osgeo Geoserver
Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/P...
The vulnerability of the jsonArrayContains() function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, allows a perpetrator to execute arbitrary code.
The vulnerability of the jsonArrayContains function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability could allow an...
CVE-2026-76904
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...
GHSA-MQJF-5F49-2FJH GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...
EUVD-2026-64133
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
CVE-2026-76904
GeoTools (open-source Java geospatial library) is affected by an unauthenticated SQL injection in the jsonArrayContains OGC Filter function within the PostGIS DataStore implementation. Affected versions are 30.5 through 33.5 (branch 33) and through 34.4 (branch 34). The root cause is that the pa...
CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
CVE-2026-76904: Improper Neutralization of Special Elements used in an SQL Command
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
PT-2026-79450
Name of the Vulnerable Software and Affected Versions GeoTools versions 30.5 through 33.5 GeoTools version 34.4 Description An SQL injection flaw exists when executing OGC Filters with the PostGIS DataStore implementation. The issue occurs within the jsonArrayContains function, which fails to...
VulnCheck KEV: CVE-2026-76904
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...
The vulnerability of the jsonArrayContains() function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, allows an attacker to disclose protected information and execute arbitrary code.
The vulnerability of the jsonArrayContains function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, is related to the lack of protective measures for the SQL query structure during the processing of the CQLFILTER parameter...