PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerabilità trovata e testata in Anteeo WMS - v4.7.31 La vulnerabilità consente agli attaccanti di creare un comando SQL all'interno del parametro username e di divulgare dati nel database sottostante. Le versioni interessate di ANTEEO B2B WMS sono dalla v.4.7.x alla v.4.7.34...

CVE-2025-58360-GeoServer-XXE

CVE-2025-58360: Laboratório XXE do GeoServer Injeção de Entidade Externa XML XXE não autenticada nos serviços OWS/WMS do GeoServer CVSS: 9.8 CRÍTICO Afetado: = 2.25.5, 2.26.0-2.26.1 Corrigido: 2.25.6+, 2.26.2+, 2.27.0+ Visão Geral Este laboratório demonstra a CVE-2025-58360, uma vulnerabilidade...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' Endpoint WMS di GeoServer Vulnerabile ad Attacco XXE 🌟 🏷️ Informazioni di Base CVE ID : CVE-2025-58360 Pubblicato : 📅 25 Novembre 2025 Ultima Modifica : 📅 25 Novembre 2025 ancora fresco al 26 Nov Tipo di Vulnerabilità : XML External Entity XXE – CWE-611 Software Affetto :...

Bypass-CVE-2025-58360

Durante la mia analisi di geoserver ho trovato un altro modo per attaccare entità esterne XML XXE non autenticate tramite l'operazione WMS GetMap. Possiamo chiamare questa vulnerabilità tramite /geoserver/workspaces/ows, utilizzando una chiamata OWS al servizio WMS invece di chiamare il servizio...

CVE-2025-58360

CVE-2025-58360 संस्करण 2.26.0 से 2.26.2 से पहले और 2.25.6 से पहले तक, एक XML External Entity XXE भेद्यता की पहचान की गई थी। एप्लिकेशन विशिष्ट एंडपॉइंट /geoserver/wms के GetMap ऑपरेशन के माध्यम से XML इनपुट स्वीकार करता है। Exploit1: root@kitploit: python3 CVE-2025-58360 -u http://example.com...

EUVD-2026-61725

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse...

EUVD-2026-61721

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse...

CVE-2026-50126

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126

adaguc-server (versions prior to 7.2.2) has a memory-safety flaw in adagucserverEC/CConvertGeoJSON.cpp: it indexes coordinate array values and uses array length as a loop bound without validating JSON node type or coordinate length, affecting Polygon, LineString, MultiLineString and MultiPolygon ...

CVE-2026-50126

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-50126 adaguc-server GeoJSON coordinate parser (CConvertGeoJSON.cpp) vulnerable to out-of-bounds read and NULL pointer dereference

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

PT-2026-77767

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Warehouse...

PT-2026-77207

Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatological and remote sensing data via OGC standards. Versions prior to 7.2.2 crash with a memory-safety fault when it parses a GeoJSON document whose geometry...

CVE-2026-63700

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-63700

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

EUVD-2026-58707

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution...

CVE-2026-66272

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2026-58683

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

GHSA-HW9R-6M78-W6H3 GeoNode contains a server-side request forgery vulnerability in the service registration endpoint

GeoNode versions 4.4.5 and 5.0.2 and prior within their respective releases contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL durin...

CVE-2026-11458 erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure

A weakness has been identified in erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69. This issue affects some unknown processing of the file /base-boot/actuator of the component Boot Actuator Endpoint. Executing a manipulation can lead to information disclosure. The attack can be...