70 matches found
geoserver-CVE-2023-25157
geoserver CVE-2023-25157 White Hat 3rd Cohort Class 30 Kim Jeong-woo github link - https://github.com/custiya/geoserver-CVE-2023-25157 Vulnerability Summary CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application. Occurs in some versions...
geoserver-
GeoServer CVE-2024-36401 Exploitation Tool GeoServer CVE-2024-36401 Environment: JDK8 Disclaimer: For authorized testing only. The author bears no responsibility for any consequences caused by user misuse. Please comply with laws and regulations! 1. Default payload: POST /geoserver/wfs HTTP/1.1...
CVE-2024-36401
CVE-2024-36401 GeoServer Exploitation Tool Vulnerability Overview CVE-2024-36401 is a remote command execution vulnerability in GeoServer. An attacker can execute arbitrary commands without authorization by crafting a specific WFS Web Feature Service request. Requirements Python 3.x Install...
CVE-2026-76904
GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...
geoexplorer
GeoExplorer Cliente Este es el componente cliente del proyecto GeoExplorer, diseñado para enviar peticiones a instancias de GeoServer y probar posibles vulnerabilidades. Requisitos Python 3.x Paquetes de Python requeridos instalar usando pip install -r requirements.txt: requests argparse urllib3...
GeoServer WFS - XXE Processing Vulnerability
GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...
CVE-2023-25157
Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...
CVE-2023-25157-GeoServer-SQLi-Lab
GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Vulnerability Lab & PoC Report Practical environment Vulnerable Lab and detailed exploitation analysis report for SQL Injection Error-based vulnerability in GeoServer CVE-2023-25157 and the GeoTools library CVE-2023-25158...
CVE-2023-25157-checker
CVE-2023-25157-checker 一个用 golang 编写的脚本。CVE-2023-25157 的 POC 使用步骤 1. git clone https://github.com/7imbitz/CVE-2023-25157-checker.git 2. cd CVE-2023-25157-checker 3. go run CVE-2023-25157.go 将 替换为目标服务器的 URL。 Google Dork inurl:"/geoserver/ows?service=wfs" 研究 出于研究目的，你可以设置并部署自己的 geoserver 实例。这款 docke...
GeoServer-CVE-2024-36401
GeoServer-CVE-2024-36401 GeoServer CVE-2024-36401: Remote Code Execution RCE Vulnerability In Evaluating Property Name Expressions GetPropertyValue root@kitploit: POST /geoserver/wfs HTTP/1.1 Host: PunitDarji Content-Type: application/xml User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...
CVE-2023-29804
WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the syssmbpwdmod function...
EUVD-2017-14626
Malware in sbrugna...
EUVD-2025-17815
Malicious code in bioql PyPI...
EUVD-2023-33343
Malicious code in bioql PyPI...
GHSA-2P76-GC46-5FVC GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...
GHSA-JJ54-8F66-C5PC [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
Summary GeoServer Web Feature Service WFS web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity XXE processing attack. It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band OOB data...
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in...
PT-2025-26488 · Maven · Org.Geonetwork-Opensource:Gn-Web-App +1
Impact GeoNetwork WFS Index functionality is affected by GeoTools XML External Entity XXE vulnerability during schema validation. This vulnerability is particularly severe as the REST API endpoint was not secured, potentially allowing unauthenticated attackers to read sensitive files Patches...
PT-2025-26262 · Maven · Org.Geotools:Gt-Wfs-Ng +1
Summary GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. Impact This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. Th...