CVE-2026-54354

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354

CVE-2026-54354 is a SQL injection vulnerability in MapServer prior to version 8.6.4 , affecting the PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter(). When a connection type of POSTGIS is configured with metadata such as gml__type=Integer, the code treat...

PT-2026-95101

Name of the Vulnerable Software and Affected Versions MapServer versions prior to 8.6.4 Description MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and the msPostGISLayerTranslateFilter function fails to verify that input from the CGI qstring or OGC API Features featureId is ...

CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...

CVE-2006-2805

SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter...

Sql injection

SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter...

CVE-2006-2805: Undefined Security Weakness

SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter...