CVE-2025-58360-GeoServer-XXE

CVE-2025-58360: GeoServer XXE Lab Unauthenticated XML External Entity XXE Injection in GeoServer OWS/WMS Services CVSS: 9.8 CRITICAL Affected: SLDHandler.parse | | - SLDParser.parseSLD | File/SSRF Quick Start Start both vulnerab...

Bypass-CVE-2025-58360

During my geoserver analysis I found another way to attack unauthenticated XML External Entities XXE via WMS GetMap operation. We can call this vulnerability via /geoserver/workspaces/ows, by using OWS call to WMS service instead of calling WMS service directly via /geoserver/wms as shown below...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerability found and tested in Anteeo WMS - v4.7.31 The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 excluded. Usage...

CVE-2025-58360

CVE-2025-58360 From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity XXE vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap Exploit1: python3 CVE-2025-58360 -u http://example.com Exploit2: curl -X PO...

CVE-2023-25157

Lab CVE-2023-25157 and CVE-2023-25158 Lab nay dung GeoServer/PostGIS de nghien cuu OGC Filter SQL injection trong moi truong cuc bo, co tach ro operator/setup mode va attacker mode. CVE-2023-25157: be mat GeoServer product, request WFS/WMS di vao JDBC filter encoding. CVE-2023-25158: root cause o...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. From version 6.4.0 to before version 8.6.3, msSLDParseUserStyle always called SLDApplyRuleValuespsRule, psLayer, 1 for any that contained . It assumed that msSLDParseRule had added a class. When the rule had no symbolizer a...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

CVE-2026-89310

A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...

CVE-2026-89309: Missing Authentication for Critical Function

The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method...

ctadirac (>=3.0.13, <=3.2.3a0), ctao-dpps-clients (>=0.7.0rc2, <=0.9.0) +1 more potentially affected by CVE-2026-61668 via dirac (>=9.1.4, <=9.1.9)

dirac PYPI version =9.1.4, =3.0.13, =0.7.0rc2, =0.7.0rc3, =0.9.0 Source cves: CVE-2026-61668 Source advisory: MEND:CVE-2026-61668...

ctadirac (>=3.0.13, <=3.2.3a0), ctao-dpps-clients (>=0.7.0rc2, <=0.9.0) +1 more potentially affected by CVE-2026-61667 via dirac (>=9.1.4, <=9.1.9)

dirac PYPI version =9.1.4, =3.0.13, =0.7.0rc2, =0.7.0rc3, =0.9.0 Source cves: CVE-2026-61667 Source advisory: MEND:CVE-2026-61667...

comdirac (>=0.22.0, <=1.3.3), ctadirac (>=2.0.0a0, <=3.0.8.dev1) +5 more potentially affected by CVE-2026-45579 via dirac (>=7.2.30, <=8.0.78)

dirac PYPI version =7.2.30, =0.22.0, =2.0.0a0, =0.0.0.dev0, =0.0.0.dev0, =33.0.0a1, =10.2.5, =10.4.23 - lhcbwebdirac 5.3.0a2 Source cves: CVE-2026-45579 Source advisory: MEND:CVE-2026-45579...

ctadirac (>=3.0.13, <=3.2.3a0), ctao-dpps-clients (>=0.7.0rc2, <=0.9.0) +1 more potentially affected by CVE-2026-45579 via dirac (>=9.1.4, <=9.1.9)

dirac PYPI version =9.1.4, =3.0.13, =0.7.0rc2, =0.7.0rc3, =0.9.0 Source cves: CVE-2026-45579 Source advisory: MEND:CVE-2026-45579...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

EUVD-2026-78675

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

Server-Side Request Forgery (SSRF)

GeoNetwork is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of caller-supplied WMS server URLs, which allows an attacker to make the server send requests to internal hosts and potentially disclose internal data, bypass authorization, or perfor...