Bypass-CVE-2025-58360

During my geoserver analysis I found another way to attack unauthenticated XML External Entities XXE via WMS GetMap operation. We can call this vulnerability via /geoserver/workspaces/ows, by using OWS call to WMS service instead of calling WMS service directly via /geoserver/wms as shown below...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

CVE-2026-89310

A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2025-58360

CVE-2025-58360 From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap Exploit1: python3 CVE-2025-58360 -u http://example.com Exploit2: curl -X PO...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerability found and tested in Anteeo WMS - v4.7.31 The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 excluded. Usage...

CVE-2023-25157

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...

CVE-2025-58360-GeoServer-XXE

CVE-2025-58360: GeoServer XXE Lab Unauthenticated XML External Entity XXE Injection in GeoServer OWS/WMS Services CVSS: 9.8 CRITICAL Affected: SLDHandler.parse | | - SLDParser.parseSLD | File/SSRF Quick Start Start both vulnerab...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. From version 6.4.0 to before version 8.6.3, msSLDParseUserStyle always called SLDApplyRuleValuespsRule, psLayer, 1 for any that contained . It assumed that msSLDParseRule had added a class. When the rule had no symbolizer a...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

EUVD-2026-78675

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

Server-Side Request Forgery (SSRF)

GeoNetwork is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of caller-supplied WMS server URLs, which allows an attacker to make the server send requests to internal hosts and potentially disclose internal data, bypass authorization, or perfor...

OSV-2026-1198 Stack-buffer-overflow in msLayoutTextSymbol

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=551099259 Crash type: Stack-buffer-overflow READ 4 Crash state: msLayoutTextSymbol msWriteErrorImage msWMSException...

EUVD-2026-61725

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse...

EUVD-2026-61721

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse...

CVE-2026-50126

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126

adaguc-server (versions prior to 7.2.2) has a memory-safety flaw in adagucserverEC/CConvertGeoJSON.cpp: it indexes coordinate array values and uses array length as a loop bound without validating JSON node type or coordinate length, affecting Polygon, LineString, MultiLineString and MultiPolygon ...