GeoServer jsonArrayContains CQL Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single...

Django RasterField - SQL Injection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. id: CVE-2026-1207 info: name: Django RasterField - SQL Injection author: omarkurt...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

geoserver-CVE-2023-25157

geoserver CVE-2023-25157 White Hat 3rd 30th group Kim Jeongwoo Enlace de GitHub - https://github.com/custiya/geoserver-CVE-2023-25157 Resumen de la vulnerabilidad CVE-2023-25157 es una vulnerabilidad SQLi que afecta a GeoServer, una aplicación web de servicio de datos cartográficos de código...

[SECURITY] Fedora 45 Update: postgresql18-postgis-3.6.4-6.fc45

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 45 Update: postgresql17-postgis-3.6.4-6.fc45

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 45 Update: postgresql16-postgis-3.6.4-6.fc45

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

Rocky Linux 10.2 [CIQ] Security Update: postgresql18-postgis / postgresql18-postgis-client / etc (crlsa-2026_67166)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202667166 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: postgis / postgis-client / postgis-client-debuginfo / etc (crlsa-2026_65899)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202665899 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

[SECURITY] Fedora 43 Update: postgresql18-postgis-3.6.4-5.fc43

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 43 Update: postgresql17-postgis-3.6.4-5.fc43

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 43 Update: postgresql16-postgis-3.6.4-5.fc43

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 44 Update: postgresql18-postgis-3.6.4-5.fc44

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 44 Update: postgresql16-postgis-3.6.4-5.fc44

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 44 Update: postgresql17-postgis-3.6.4-5.fc44

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

Fedora 43 : postgresql16-postgis / postgresql17-postgis / postgresql18-postgis (2026-bb0d483289)

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-bb0d483289 advisory. Backport fix for CVE-2026-73515. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

Fedora 44 : postgresql16-postgis / postgresql17-postgis / postgresql18-postgis (2026-0fe48ab374)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-0fe48ab374 advisory. Backport fix for CVE-2026-73515. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

BIT-POSTGIS-2026-73515 PostGIS < 3.7.0 Out-of-Bounds Read via FlatGeobuf Buffer

PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the...

PT-2026-99013

PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the...

CVE-2026-54354

A flaw was found in MapServer, a system for developing web-based Geographic Information System GIS applications. The PostGIS runtime filter translation incorrectly processes attacker-controlled input as numeric without proper validation. This allows an unauthenticated remote attacker, with access...