CVE-2025-21621

CVE-2025-21621 affects GeoServer prior to version 2.25.0, with a reflected XSS vulnerability in the WMS GetFeatureInfo HTML output format. This could enable arbitrary JavaScript execution in a victim’s browser via specially crafted SLD_BODY parameters. The issue has been patched in 2.25.0. Exploi...