Vendor
MapServer
57 known vulnerabilities in products by MapServer, 0 of them actively exploited (CISA KEV).
Key figures
57
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
9
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-30220 | OSGeo GeoServer: Improper Restriction of XML External Entity Reference | 9.9 | |
| Critical | CVE-2023-25157 | Unfiltered SQL Injection Vulnerabilities in Geoserver | 9.8 | |
| Critical | CVE-2023-43795 | WPS Server Side Request Forgery in GeoServer | 8.6 | |
| Critical | CVE-2017-5522 | MapServer: Stack-Based Buffer Overflow | 9.8 | |
| High | CVE-2021-40822 | OSGeo GeoServer: Server-Side Request Forgery (SSRF) | 7.5 | |
| Critical | CVE-2019-17545 | GDAL: Double Free | 9.8 | |
| High | CVE-2019-17546 | LibTiff: Heap-Based Buffer Overflow | 8.8 | |
| High | CVE-2024-29198 | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost | 7.5 | |
| Critical | CVE-2022-0699 | Shapelib: Use After Free | 9.8 | |
| High | CVE-2010-1678 | MapServer: security vulnerability | 7.5 | |
| High | CVE-2025-27511 | GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection | 7.2 | |
| High | CVE-2021-39371 | GDAL Owslib: XML External Entity (XXE) | 7.5 | |
| High | CVE-2022-24847 | Improper Input Validation in GeoServer | 7.2 | |
| High | CVE-2016-9839 | MapServer: security vulnerability | 7.5 | |
| High | CVE-2021-28398 | Osgeo Geonetwork: security vulnerability | 7.2 | |
| High | CVE-2026-33721 | MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing | 5.3 | |
| High | CVE-2025-52465 | GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page | 7.2 | |
| High | CVE-2023-27476 | XML External Entity (XXE) Injection in OWSLib | 8.2 | |
| High | CVE-2022-50899 | Geonetwork 4.2.0 - XML External Entity (XXE) | 6.5 | |
| Not rated | CVE-2009-0839 | MapServer: Stack-Based Buffer Overflow | — | |
| Medium | CVE-2021-45943 | GDAL: Heap-Based Buffer Overflow | 5.5 | |
| Medium | CVE-2025-27505 | GeoServer Missing Authorization on REST API Index | 5.3 | |
| Medium | CVE-2021-32062 | MapServer: security vulnerability | 5.3 | |
| Critical | CVE-2025-59431 | MapServer - WFS XML Filter Query SQL injection | 9.8 | |
| Not rated | CVE-2009-2281 | MapServer: Heap-Based Buffer Overflow | — |
Products
| MapServer | 22 | 0 |
| OSGeo GeoServer | 16 | 0 |
| GDAL | 13 | 0 |
| GeoNetwork | 4 | 0 |