geoserver-

GeoServer CVE-2024-36401 Exploitation Tool GeoServer CVE-2024-36401 Environment: JDK8 Disclaimer: For authorized testing only. The author bears no responsibility for any consequences caused by user misuse. Please comply with laws and regulations! 1. Default payload: POST /geoserver/wfs HTTP/1.1...

CVE-2024-36401

CVE-2024-36401 GeoServer Exploitation Tool Vulnerability Overview CVE-2024-36401 is a remote command execution vulnerability in GeoServer. An attacker can execute arbitrary commands without authorization by crafting a specific WFS Web Feature Service request. Requirements Python 3.x Install...

CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Laboratorio de Vulnerabilidad e Informe de PoC Entorno de práctica Laboratorio Vulnerable e informe detallado de análisis de explotación de la vulnerabilidad SQL Injection Error-based en GeoServer CVE-2023-25157 y la biblioteca...

GeoServer WFS - XXE Processing Vulnerability

GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...

geoexplorer

GeoExplorer Client This is the client component of the GeoExplorer project, designed to send requests to GeoServer instances and test for potential vulnerabilities. Requirements Python 3.x Required Python packages install using pip install -r requirements.txt: requests argparse urllib3 Usage Run...

CVE-2023-25157-checker

CVE-2023-25157-checker Un script, escrito en golang. POC para CVE-2023-25157 Pasos para usar 1. git clone https://github.com/7imbitz/CVE-2023-25157-checker.git 2. cd CVE-2023-25157-checker 3. go run CVE-2023-25157.go Reemplaza con la URL del servidor objetivo. Google Dork...

GeoServer-CVE-2024-36401

GeoServer-CVE-2024-36401 GeoServer CVE-2024-36401: Remote Code Execution RCE Vulnerability In Evaluating Property Name Expressions GetPropertyValue POST /geoserver/wfs HTTP/1.1 Host: PunitDarji Content-Type: application/xml User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36...

geoserver-CVE-2023-25157

geoserver CVE-2023-25157 White Hat 3rd 30th group Kim Jeongwoo Enlace de GitHub - https://github.com/custiya/geoserver-CVE-2023-25157 Resumen de la vulnerabilidad CVE-2023-25157 es una vulnerabilidad SQLi que afecta a GeoServer, una aplicación web de servicio de datos cartográficos de código...

[SECURITY] Fedora 45 Update: tinyows-1.2.2-10.fc45

TinyOWS server implements latest Open Geospatial Consortium Transactional Web Feature Service WFS-T standard versions, as well as related standards such as Filter Encoding FE...

CVE-2023-25157

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...

CVE-2026-76904

GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...

Exploit for SQL Injection in Osgeo Geoserver

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/P...

Exploit for CVE-2026-76904

GeoServer WFS Inventory und autorisierte Verifikation Dieses...

CVE-2023-29804

WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the syssmbpwdmod function...

EUVD-2017-14626

Malware in sbrugna...

EUVD-2025-17815

Malicious code in bioql PyPI...

EUVD-2023-33343

Malicious code in bioql PyPI...

GHSA-2P76-GC46-5FVC GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint

Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...

GHSA-JJ54-8F66-C5PC [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service

Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...

CVE-2025-30220

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in...