TileServer API - Cross Site Scripting

tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting XSS vulnerability via the component /data/v3/?key. id: CVE-2024-35627 info: name: TileServer API - Cross Site Scripting author: DhiyaneshDK severity: medium description: | tileserver-gl up to v4.4.10 was discovered to...

TileServer GL <=3.0.0 - Cross-Site Scripting

TileServer GL through 3.0.0 is vulnerable to reflected cross-site scripting via server.js because the content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page. id: CVE-2020-15500 info: name: TileServer GL =3.0.0 - Cross-Site Scripting author:...

MapTiler Tileserver-php v2.0 - Unauthenticated XSS

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter "layer" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers. id: CVE-2025-44136 info: name: MapTiler Tileserver-php v2.0 - Unauthenticated XSS...

MapTiler Tileserver-php v2.0 - Unauthenticated File Read

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests id: CVE-2025-44137 info: name: MapTiler Tileserver-php v2.0 -...

CVE-2025-44136

CVE-2025-44136 Unauthenticated XSS in MapTiler Tileserver-php v2.0. Description MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting XSS. The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to...

CVE-2025-44137

CVE-2025-44137 Unauthenticated File Read in MapTiler Tileserver-php v2.0. Description MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creati...

GHSA-RGJ7-G3M4-5G8C vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: langfuse, tileserver-gl...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: langfuse, tileserver-gl...

GHSA-P498-V437-472G vulnerabilities

Vulnerabilities for packages: vitess, langfuse, tileserver-gl...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: lambda-nodejs, tileserver-gl, langfuse, librechat, tileserver-gl-fips, langfuse-fips...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: lambda-nodejs, tileserver-gl, langfuse, librechat, tileserver-gl-fips, langfuse-fips...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: tileserver-gl, jitsucom-jitsu, kibana, langfuse, tileserver-gl-fips, langfuse-fips, thingsboard-fips...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, tileserver-gl...

CVE-2026-5078 vulnerabilities

Vulnerabilities for packages: tileserver-gl, tileserver-gl-fips, azurite, wazuh-dashboard-fips, wazuh-dashboard...

GHSA-4VJ7-5MJ6-JM8M vulnerabilities

Vulnerabilities for packages: tileserver-gl, tileserver-gl-fips, azurite, wazuh-dashboard-fips, wazuh-dashboard...

GHSA-4VJ7-5MJ6-JM8M vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-8R6M-32JQ-JX6Q vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, tileserver-gl...

CVE-2026-5078 vulnerabilities

Vulnerabilities for packages: tileserver-gl...

GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: renovate, langfuse, json-server, code-server, kubeflow-centraldashboard, saf, thingsboard, tileserver-gl, kubeflow-katib, argo-workflows, kubeflow-pipelines, prism, py3-jupyterlab, opensearch-dashboards, sqlpad...