70 matches found
geoserver-CVE-2023-25157
geoserver CVE-2023-25157 White Hat 3rd Cohort Class 30 Kim Jeong-woo github link - https://github.com/custiya/geoserver-CVE-2023-25157 Vulnerability Summary CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application. Occurs in some versions...
CVE-2023-25157-GeoServer-SQLi-Lab
GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Laboratorio de Vulnerabilidad e Informe de PoC Entorno de práctica Laboratorio Vulnerable e informe detallado de análisis de explotación de la vulnerabilidad SQL Injection Error-based en GeoServer CVE-2023-25157 y la biblioteca...
geoexplorer
GeoExplorer 클라이언트 이것은 GeoExplorer 프로젝트의 클라이언트 구성 요소로, GeoServer 인스턴스에 요청을 보내고 잠재적인 취약점을 테스트하도록 설계되었습니다. 요구 사항 Python 3.x 필요한 Python 패키지 다음 명령어로 설치: pip install -r requirements.txt: requests argparse urllib3 사용법 다음 명령어로 스크립트를 실행하세요: python main.py -u -t -c 인수: -u: 대상 URL 또는 줄바꿈으로 구분된 URL이 포함된 파일 필...
GeoServer WFS - XXE Processing Vulnerability
GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...
geoserver-
geoserver CVE-2024-36401 エクスプロイトツール geoserver CVE-2024-36401 環境: JDK8 宣言: 許可されたテストにのみ使用し、ユーザーによる悪用の結果はすべて作者の責任ではありません。法律と規制を遵守してください！ 1, デフォルトペイロード: POST /geoserver/wfs HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/124.0.6367.118...
CVE-2023-25157-checker
CVE-2023-25157-checker A script, written in golang. POC for CVE-2023-25157 Steps to use 1. git clone https://github.com/7imbitz/CVE-2023-25157-checker.git 2. cd CVE-2023-25157-checker 3. go run CVE-2023-25157.go Replace with the URL of the target server. Google Dork...
GeoServer-CVE-2024-36401
GeoServer-CVE-2024-36401 GeoServer CVE-2024-36401: Remote Code Execution RCE Vulnerability In Evaluating Property Name Expressions GetPropertyValue root@kitploit: POST /geoserver/wfs HTTP/1.1 Host: PunitDarji Content-Type: application/xml User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...
CVE-2024-36401
CVE-2024-36401 GeoServer Exploitation Tool Vulnerability Overview CVE-2024-36401 is a remote command execution vulnerability in GeoServer. An attacker can execute arbitrary commands without authorization by crafting a specific WFS Web Feature Service request. Requirements Python 3.x Install...
CVE-2023-25157
Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...
CVE-2026-76904
GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...
CVE-2023-29804
WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the syssmbpwdmod function...
EUVD-2017-14626
Malware in sbrugna...
EUVD-2025-17815
Malicious code in bioql PyPI...
EUVD-2023-33343
Malicious code in bioql PyPI...
GHSA-2P76-GC46-5FVC GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...
GHSA-JJ54-8F66-C5PC [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in...
PT-2025-26488 · Maven · Org.Geonetwork-Opensource:Gn-Web-App +1
Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...
PT-2025-26262 · Maven · Org.Geotools:Gt-Wfs-Ng +1
Summary GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. Impact This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. Th...