MapTiler Tileserver-php v2.0 - Unauthenticated XSS

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter "layer" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers. id: CVE-2025-44136 info: name: MapTiler Tileserver-php v2.0 - Unauthenticated XSS...

MapTiler Tileserver-php v2.0 - Unauthenticated File Read

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests id: CVE-2025-44137 info: name: MapTiler Tileserver-php v2.0 -...

CVE-2025-44136

CVE-2025-44136 MapTiler Tileserver-php v2.0 中的未认证 XSS 漏洞 描述 MapTiler Tileserver-php v2.0 存在跨站脚本（XSS）漏洞。GET 参数 "layer" 在错误消息中直接反射，未进行 HTML 编码。这导致 XSS，允许未经认证的攻击者在受害者浏览器上执行任意 HTML 或 JavaScript 代码。...

CVE-2025-44137

CVE-2025-44137 Lectura de archivos no autenticada en MapTiler Tileserver-php v2.0. Descripción MapTiler Tileserver-php v2.0 es vulnerable a Directory Traversal. La función renderTile dentro de tileserver.php es responsable de entregar tiles que se almacenan como archivos en el servidor mediante u...

VulnCheck KEV: CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web...

EUVD-2025-23022

Malicious code in bioql PyPI...

EUVD-2025-23023

Malicious code in bioql PyPI...

EUVD-2024-33155

Malicious code in bioql PyPI...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is affected by a Directory Traversal in the renderTile function of tileserver.php. Improper sanitization of GET parameters allows crafting requests that insert ../ sequences to read arbitrary files on the server. Affected parameters include TileMatrix, TileRow, TileCo...

TileServer PHP 安全漏洞

TileServer PHP is a folder hosting software from MapTiler Open Source. A security vulnerability exists in TileServer PHP version v2.0, which stems from the layer parameter not being HTML-encoded, and could lead to a cross-site scripting attack...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is affected by an unauthenticated reflected XSS in the GET parameter layer, which is echoed in an error message without HTML encoding. This allows an attacker to execute arbitrary HTML/JavaScript in a victim’s browser. Connected sources confirm the vulnerable componen...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

TileServer PHP 安全漏洞

TileServer PHP is a folder hosting software from MapTiler Open Source. A security vulnerability exists in TileServer PHP version v2.0, which stems from a path traversal allowed by the renderTile function that could lead to reading arbitrary files...

PT-2025-31223 · Maptiler · Maptiler Tileserver-Php

Name of the Vulnerable Software and Affected Versions: MapTiler Tileserver-php version 2.0 Description: MapTiler Tileserver-php version 2.0 is susceptible to a Cross Site Scripting XSS issue. The layer GET parameter is reflected in an error message without proper HTML encoding. This allows an...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web...