TileServer GL <=3.0.0 - Cross-Site Scripting

TileServer GL through 3.0.0 is vulnerable to reflected cross-site scripting via server.js because the content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page. id: CVE-2020-15500 info: name: TileServer GL =3.0.0 - Cross-Site Scripting author:...

TileServer API - Cross Site Scripting

tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting XSS vulnerability via the component /data/v3/?key. id: CVE-2024-35627 info: name: TileServer API - Cross Site Scripting author: DhiyaneshDK severity: medium description: | tileserver-gl up to v4.4.10 was discovered to...

MapTiler Tileserver-php v2.0 - Unauthenticated XSS

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter "layer" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers. id: CVE-2025-44136 info: name: MapTiler Tileserver-php v2.0 - Unauthenticated XSS...

MapTiler Tileserver-php v2.0 - Unauthenticated File Read

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests id: CVE-2025-44137 info: name: MapTiler Tileserver-php v2.0 -...

CVE-2025-44137

CVE-2025-44137 MapTiler Tileserver-php v2.0 における認証なしファイル読み取り 説明 MapTiler Tileserver-php v2.0 はディレクトリトラバーサルに対して脆弱です。tileserver.php 内の renderTile 関数は、Web リクエストを介してサーバー上のファイルとして保存されたタイルを配信します。ファイルへのパスを作成する際に '../' を使用できるため、Web サーバー上の任意のファイルを読み取ることが可能です。 影響を受ける GET...

CVE-2025-44136

CVE-2025-44136 MapTiler Tileserver-php v2.0における認証不要のXSS 説明 MapTiler Tileserver-php v2.0はクロスサイトスクリプティング（XSS）に対して脆弱です。GETパラメータ「layer」がHTMLエンコードされずにエラーメッセージに反映されます。これによりXSSが発生し、認証されていない攻撃者が被害者のブラウザ上で任意のHTMLまたはJavaScriptコードを実行できるようになります。...

GHSA-RGJ7-G3M4-5G8C vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: langfuse, tileserver-gl...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: langfuse, tileserver-gl...

GHSA-P498-V437-472G vulnerabilities

Vulnerabilities for packages: vitess, langfuse, tileserver-gl...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: langfuse-fips, lambda-nodejs, tileserver-gl-fips, tileserver-gl, langfuse, librechat...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: langfuse-fips, lambda-nodejs, tileserver-gl-fips, tileserver-gl, langfuse, librechat...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: langfuse-fips, tileserver-gl-fips, kibana, langfuse, tileserver-gl, thingsboard-fips, jitsucom-jitsu...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, tileserver-gl...

CVE-2026-5078 vulnerabilities

Vulnerabilities for packages: azurite, tileserver-gl-fips, tileserver-gl, wazuh-dashboard, wazuh-dashboard-fips...

GHSA-4VJ7-5MJ6-JM8M vulnerabilities

Vulnerabilities for packages: azurite, tileserver-gl-fips, tileserver-gl, wazuh-dashboard, wazuh-dashboard-fips...

GHSA-4VJ7-5MJ6-JM8M vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-8R6M-32JQ-JX6Q vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, tileserver-gl...

CVE-2026-5078 vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, thingsboard, tileserver-gl, json-server, kubeflow-centraldashboard, code-server, langfuse, py3-jupyterlab, renovate, prism, argo-workflows, saf, kubeflow-katib, opensearch-dashboards, sqlpad...