cve-2024-36401-geoserver-rce

CVE-2024-36401 — GeoServer의 인증되지 않은 RCE CVE-2024-36401 에 대한 완전하고 재현 가능한 연구 자료입니다. 이 취약점은 지리공간 데이터를 위한 가장 널리 배포된 오픈소스 서버인 GeoServer의 인증되지 않은 원격 코드 실행 결함입니다. 이 버그는 eval 인젝션 입니다. OGC 표준의 파라미터를 통해 GeoServer는 공격자가 제어하는 속성 이름property name을 GeoTools에 전달하며, GeoTools에서는 Apache Commons JXPath 가 이를 XPath...

CVE-2023-25157

CVE-2023-25157 - GeoServer SQL注入 - PoC CVE: CVE-2023-25157 日期: 2023年6月6日 厂商/软件: GeoServer 严重性: 9.8/10 - 该脚本是GeoServer（一种流行的用于共享地理空间数据的开源软件服务器）中OGC Filter SQL注入漏洞的概念验证。它向目标URL发送请求，并通过向CQLFILTER参数注入恶意载荷来利用潜在漏洞。出于实验目的，该脚本使用SELECT version SQL语句作为载荷。 使用方法 使用此脚本时，请将目标URL作为命令行参数提供。例如： root@kitploit:...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2023-25157

CVE-2023-25157 GeoServer OGC Filter SQL-Injection-Schwachstellen...

CVE-2024-36401-poc

CVE-2024-36401 — Iniezione XPath OGC in GeoServer RCE Exploit di esecuzione remota di codice non autenticata per GeoServer tramite iniezione del parametro valueReference del filtro OGC valutazione XPath/JXPath. Disclaimer: Questo strumento è destinato esclusivamente a test di penetrazione...

VulnCheck KEV: CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

Exploit for SQL Injection in Osgeo Geoserver

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-...

PYSEC-2026-2986 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

CVE-2026-42352 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3...

GHSA-JGVC-94C8-3CHC pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

EUVD-2011-2684

Malware in sbrugna...

EUVD-2011-2685

Malware in sbrugna...

EUVD-2023-0675

Malicious code in bioql PyPI...

Exploit for Code Injection in Geoserver

CVE-2024-36401-poc CVE-2024-36401 is a high-risk remote code...

Malicious code in @dp-bpsc-tiktok/ogc-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 392d2ec573af02b972bc2bb4fd5b33b1c1f6bd8a2962744ed929259effae7c82 The OpenSSF Package Analysis project identified '@dp-bpsc-tiktok/ogc-analytics' @ 1.0.0 npm as malicious. It is considered malicious because: -...

Exploit for Code Injection in Geoserver

🚀 GeoServer Exploit for CVE-2024-36401 🚀 📝 Description...

Geoserver Unauthenticated Remote Code Execution Exploit

GeoServer is an open-source software server written in Java that provides the ability to view, edit, and share geospatial data. It is designed to be a flexible, efficient solution for distributing geospatial data from a variety of sources such as Geographic Information System GIS databases,...

Geoserver Unauthenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geoserver unauthenticated Remote Code Execution', 'Description' = %q GeoServer is an open-source software server written in Java that provides th...

Remote Code Execution (RCE) vulnerability in geoserver

Summary Multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. Details The GeoTools library API that GeoServer calls evaluates...

GHSA-6JJ6-GM7P-FCVV Remote Code Execution (RCE) vulnerability in geoserver

Summary Multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. Details The GeoTools library API that GeoServer calls evaluates...