CVE-2023-25157

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...

CVE-2023-25157

CVE-2023-25157 - Inyección SQL en GeoServer - PoC CVE: CVE-2023-25157 Fecha: 06/06/2023 Proveedor/Software: GeoServer Severidad: 9.8/10 - Este script es una prueba de concepto para las vulnerabilidades de inyección SQL en el filtro OGC en GeoServer, un popular servidor de software de código abier...

CVE-2026-55864

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2023-25157

CVE-2023-25157 Vulnerabilidades de inyección SQL en filtros OGC de GeoServer...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — RCE no autenticada en GeoServer Un estudio completo y reproducible de la vulnerabilidad CVE-2024-36401 , un fallo de ejecución remota de código no autenticado en GeoServer — el servidor de código abierto más utilizado para datos geoespaciales. El error es una inyección de eval : ...

CVE-2024-36401-poc

CVE-2024-36401 — GeoServer OGC XPath Injection RCE Unauthenticated Remote Code Execution exploit for GeoServer via OGC filter valueReference parameter injection XPath/JXPath evaluation. Disclaimer: This tool is intended for authorized penetration testing and security research only. Do not use...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

VulnCheck KEV: CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

Exploit for SQL Injection in Osgeo Geoserver

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-...

PYSEC-2026-2986 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

CVE-2026-42352 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3...

GHSA-JGVC-94C8-3CHC pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

EUVD-2011-2685

Malware in sbrugna...

EUVD-2011-2684

Malware in sbrugna...

EUVD-2023-0675

Malicious code in bioql PyPI...

Exploit for Code Injection in Geoserver

CVE-2024-36401-poc CVE-2024-36401 is a high-risk remote code...

Malicious code in @dp-bpsc-tiktok/ogc-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 392d2ec573af02b972bc2bb4fd5b33b1c1f6bd8a2962744ed929259effae7c82 The OpenSSF Package Analysis project identified '@dp-bpsc-tiktok/ogc-analytics' @ 1.0.0 npm as malicious. It is considered malicious because: -...

Exploit for Code Injection in Geoserver

🚀 GeoServer Exploit for CVE-2024-36401 🚀 📝 Description...

Geoserver Unauthenticated Remote Code Execution Exploit

GeoServer is an open-source software server written in Java that provides the ability to view, edit, and share geospatial data. It is designed to be a flexible, efficient solution for distributing geospatial data from a variety of sources such as Geographic Information System GIS databases,...

Geoserver Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geoserver unauthenticated Remote Code Execution', 'Description' = %q GeoServer is an open-source software server written in Java that provides th...