cve-2025-58360

GeoServer: CVE-2025-58360 免責事項 このリポジトリに含まれるコードおよび情報は、教育および研究目的のみで提供されています。リポジトリの管理者は、あなたがこのコードや情報を用いて行う一切の行為について責任を負いません。あなたの行動はあなた自身の責任です。法律および倫理に従って適切に使用してください。 Python3 クラス exploit/exploiter.py ファイル内の Python3 クラス（GeoDumper）は、XXE 脆弱性の悪用を自動化し、漏洩した情報をローカルファイルに保存します。 例： root@kitploit: import...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

CVE-2025-58360

CVE-2025-58360 バージョン2.26.0から2.26.2未満、および2.25.6未満において、XML External Entity（XXE）の脆弱性が確認されました。このアプリケーションは、特定のエンドポイント /geoserver/wms の GetMap 操作を通じてXML入力を受け付けます。 エクスプロイト1: root@kitploit: python3 CVE-2025-58360 -u http://example.com エクスプロイト2: root@kitploit: curl -X POST...

Bypass-CVE-2025-58360

GeoServer分析中に、WMS GetMap操作を介して認証されていないXML外部エンティティ（XXE）を攻撃する別の方法を発見しました。この脆弱性は、下記に示すように、/geoserver/wmsからWMSサービスを直接呼び出す代わりに、OWS呼び出しを使用して/geoserver/workspaces/ows経由でWMSサービスを呼び出すことで利用できます。 curl -X POST...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMSエンドポイントがXXE攻撃に対して脆弱 🌟 🏷️ 基本情報 CVE ID : CVE-2025-58360 公開日 : 📅 2025年11月25日 最終更新日 : 📅 2025年11月25日（11月26日時点でまだ新しい） 脆弱性タイプ : XML External Entity XXE – CWE-611 影響を受けるソフトウェア : GeoServer（Javaで書かれたオープンソースの地理空間サーバー） 深刻度 : 🔥 高 – CVSS v3.1 Base Score 7.5 Vector:...

SUSE CVE-2026-33721

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer's SLD Styled Layer Descriptor parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with mor...

CVE-2026-33721

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD Styled Layer Descriptor parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with mor...

UBUNTU-CVE-2026-33721

MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD Styled Layer Descriptor parser lets a remote, unauthenticated attacker crash the MapServer process by sending a crafted SLD with mor...

Vulnerability fixed in GeoServer

OSGeo has fixed a vulnerability in GeoServer. The vulnerability is in the way GeoServer processes XML input, specifically via the /geoserver/wms GetMap operation. Improper sanitation of XML input allows attackers to disclose sensitive files or conduct denial-of-service attacks using custom XML...

OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability

OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request...

VulnCheck KEV: CVE-2025-58360

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap...

CVE-2025-58360

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap...

CVE-2025-58360 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap...

CVE-2025-58360 GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap...

CVE-2025-58360

CVE-2025-58360 : GeoServer contains an XML External Entity (XXE) vulnerability in the GetMap operation (/geoserver/wms). The issue arises from insufficient XML input sanitization, allowing external entities to be defined in requests. Affected: GeoServer versions 2.26.0–2.26.1 and 2.25.0–2.25.5 (i...

GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Description An XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML...

GHSA-FJF5-XGMQ-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Description An XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML...

PT-2025-48086

Name of the Vulnerable Software and Affected Versions: GeoServer versions 2.26.0 through 2.26.1 and versions prior to 2.25.6 Description: GeoServer is an open-source server for sharing and editing geospatial data. A vulnerability exists due to improper restriction of XML external entity reference...

GeoServer 代码问题漏洞

GeoServer is GeoServer open source an open source software server written in Java. It allows users to share and edit geospatial data. A code issue vulnerability exists in GeoServer versions 2.26.0 through prior to 2.26.2 and prior to 2.25.6, which stems from insufficiently cleaned or restricted X...

GeoServer WMS GetMap XXE Arbitrary File Read

This module exploits an XML External Entity XXE vulnerability in GeoServer via the WMS GetMap operation. The vulnerability allows reading arbitrary files from the server's file system by injecting an XXE entity in the SLD Styled Layer Descriptor. Affected versions: - GeoServer = 2.26.0, use...