CVE-2025-44136

CVE-2025-44136 MapTiler Tileserver-php v2.0 中的未认证 XSS 漏洞 描述 MapTiler Tileserver-php v2.0 存在跨站脚本（XSS）漏洞。GET 参数 "layer" 在错误消息中直接反射，未进行 HTML 编码。这导致 XSS，允许未经认证的攻击者在受害者浏览器上执行任意 HTML 或 JavaScript 代码。...

CVE-2025-44137

CVE-2025-44137 MapTiler Tileserver-php v2.0 中的未认证文件读取。 描述 MapTiler Tileserver-php v2.0 存在目录遍历漏洞。tileserver.php 中的 renderTile 函数负责通过 Web 请求传递存储在服务器上作为文件的瓦片。构造文件路径时允许使用 '../'，可借此读取 Web 服务器上的任意文件。 受影响的 GET 参数为 "TileMatrix"、"TileRow"、"TileCol" 和 "Format"...

VulnCheck KEV: CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

CVE-2025-44137

MapTiler Tileserver-php v2.0 is affected by a Directory Traversal in the renderTile function of tileserver.php. Improper sanitization of GET parameters allows crafting requests that insert ../ sequences to read arbitrary files on the server. Affected parameters include TileMatrix, TileRow, TileCo...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is affected by an unauthenticated reflected XSS in the GET parameter layer, which is echoed in an error message without HTML encoding. This allows an attacker to execute arbitrary HTML/JavaScript in a victim’s browser. Connected sources confirm the vulnerable componen...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...

PT-2025-31223 · Maptiler · Maptiler Tileserver-Php

Name of the Vulnerable Software and Affected Versions: MapTiler Tileserver-php version 2.0 Description: MapTiler Tileserver-php version 2.0 is susceptible to a Cross Site Scripting XSS issue. The layer GET parameter is reflected in an error message without proper HTML encoding. This allows an...

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser...