GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

Django RasterField - SQL Injection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. id: CVE-2026-1207 info: name: Django RasterField - SQL Injection author: omarkurt...

GeoServer jsonArrayContains CQL Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single...

geoserver-CVE-2023-25157

geoserver CVE-2023-25157 الفريق الأبيض White Hat الدفعة الثالثة الصف 30 كيم جونغ-وو رابط جيثب - https://github.com/custiya/geoserver-CVE-2023-25157 ملخص الثغرة CVE-2023-25157 هي ثغرة SQLi تصيب GeoServer، وهو تطبيق ويب مفتوح المصدر لخدمات بيانات الخرائط تحدث في بعض إصدارات GeoServer حتى 2.22.0 وما...

CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the jsonArrayContains function. An attacker can execute arbitrary SQL statements by supplying crafted input to the filter, which is incorporated into SQL queries without proper escaping. Remediation Upgrade...

EUVD-2026-64133

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904

GeoTools (open-source Java geospatial library) is affected by an unauthenticated SQL injection in the jsonArrayContains OGC Filter function within the PostGIS DataStore implementation. Affected versions are 30.5 through 33.5 (branch 33) and through 34.4 (branch 34). The root cause is that the pa...

PT-2026-79450

Name of the Vulnerable Software and Affected Versions GeoTools versions 30.5 through 33.5 GeoTools version 34.4 Description An SQL injection flaw exists when executing OGC Filters with the PostGIS DataStore implementation. The issue occurs within the jsonArrayContains function, which fails to...

VulnCheck KEV: CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-73515

A flaw was found in PostGIS. This out-of-bounds read vulnerability allows a remote attacker to cause memory disclosure or a server crash. This occurs when a malformed FlatGeobuf buffer is supplied, as the FlatGeobuf property metadata decoder fails to verify that the string body is contained withi...

Linux Distros Unpatched Vulnerability : CVE-2026-73515

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malform...

CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...

DEBIAN-CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...

CVE-2026-73514

The addressstandardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardizeaddress to trigger memory corruption by providing a rules table...

UBUNTU-CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...

CVE-2026-73515

PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that th...