48 matches found
CVE-2026-44672 mapfish-print: Remote Code Injection (RCE) in Dynamic table
mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22,...
CVE-2026-44672 mapfish-print: Remote Code Injection (RCE) in Dynamic table
mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22,...
mapfish-print 代码注入漏洞
Mapfish-Print is a JAVA extension library created by individual developers for creating maps-related reports. This extension library is based on Java’s servlet/lib/application framework and can implement a service that receives requests and returns reports. Versions of Mapfish-Print from 3.23.0 t...
CVE-2026-44672: Improper Control of Generation of Code
mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30, 3.31.22, 3.33.14, and 4.0.3, the attacker can execute arbitrary code in Dynamic table without being authenticated. This vulnerability is fixed in 3.28.28, 3.30.30, 3.31.22,...
Mapfish Print: Remote Code Injection (RCE) in Dynamic table
Impact The attacker can execute arbitrary code without being authenticated Mitigation Upgrade to a patched version please check affected/patched version matrix Credits Bug Bounty of Canton du Jura...
Arbitrary Code Injection
Overview org.mapfish.print:print-lib is a component of MapFish for printing templated cartographic maps. Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamic table. An attacker can execute arbitrary code by sending specially crafted requests without...
GHSA-Q7M6-WPVF-MVWX Mapfish Print: Remote Code Injection (RCE) in Dynamic table
Impact The attacker can execute arbitrary code without being authenticated Mitigation Upgrade to a patched version please check affected/patched version matrix Credits Bug Bounty of Canton du Jura...
EUVD-2020-0574
Malware in sbrugna...
EUVD-2020-0572
Malware in sbrugna...
CVE-2020-15232
In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...
CVE-2020-15231
In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...
Cross-Site Scripting (XSS)
mapfish-print is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via JSONP...
CVE-2020-15232
In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...
CVE-2020-15231
In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...
CVE-2020-15232
In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...
CVE-2020-15231
In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...
Cross site scripting
In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...
Xxe
In mapfish-print before version 3.24, a user can do to an XML External Entity XXE attack with the provided SDL style...
CVE-2020-15232
The CVE-2020-15232 issue affects mapfish-print prior to version 3.24, where XML External Entity (XXE) processing is vulnerable via the SDL parser (DTDs are not disabled), enabling an attacker to inject untrusted entities. Public advisories describe remote XXE exploitation, with remediation statin...