CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
GeoServer GetMap Endpoint XML External Entity (XXE) Injection Vulnerability Advisory (CVE-2025-58360)
[Affected Scope] GeoServer versions from 2.25.0 to before 2.25.6, and from 2.26.0 to before 2.26.3
[Impact] Unauthenticated remote attackers can exploit the GetMap XML request to read arbitrary local files, perform Server-Side Request Forgery (SSRF), or trigger Denial of Service (DoS)
[Mitigation] Immediately upgrade GeoServer to patched versions 2.25.6, 2.26.3, or 2.27.0 and above
GeoServer Remote Code Execution (RCE) Critical Security Advisory (CVE-2024-36401)
[Affected Scope] All default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2
[Impact] Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters
[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file
GeoServer & JAI-EXT Jiffle Script Compiler Remote Code Execution (RCE) Vulnerability (CVE-2022-24816) Analysis and Mitigation Guide
[Affected Scope] Java applications utilizing JAI-EXT library versions prior to 1.2.22, including downstream GeoServer deployments.
[Impact] Unauthenticated remote attackers can execute arbitrary Java code on the target server by injecting malicious Jiffle scripts, leading to complete system compromise.
[Mitigation] Immediately upgrade JAI-EXT to version 1.2.22 or higher, or temporarily remove the Janino compiler JAR file from the classpath.