CVE-2025-44136

CVE-2025-44136 XSS non autenticato in MapTiler Tileserver-php v2.0. Descrizione MapTiler Tileserver-php v2.0 è vulnerabile a Cross Site Scripting XSS. Il parametro GET "layer" viene riflesso in un messaggio di errore senza codifica HTML. Ciò porta a XSS e consente a un attaccante non autenticato ...

CVE-2025-44137

CVE-2025-44137 Lettura di file non autenticata in MapTiler Tileserver-php v2.0. Descrizione MapTiler Tileserver-php v2.0 è vulnerabile a Directory Traversal. La funzione renderTile all'interno di tileserver.php è responsabile della consegna delle tile memorizzate come file sul server tramite...

VulnCheck KEV: CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is affected by a Directory Traversal in the renderTile function of tileserver.php. Improper sanitization of GET parameters allows crafting requests that insert ../ sequences to read arbitrary files on the server. Affected parameters include TileMatrix, TileRow, TileCo...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is affected by an unauthenticated reflected XSS in the GET parameter layer, which is echoed in an error message without HTML encoding. This allows an attacker to execute arbitrary HTML/JavaScript in a victim’s browser. Connected sources confirm the vulnerable componen...

PT-2025-31223 · Maptiler · Maptiler Tileserver-Php

Name of the Vulnerable Software and Affected Versions: MapTiler Tileserver-php version 2.0 Description: MapTiler Tileserver-php version 2.0 is susceptible to a Cross Site Scripting XSS issue. The layer GET parameter is reflected in an error message without proper HTML encoding. This allows an...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...