Product by MapServer
OSGeo GeoServer
16 known vulnerabilities in OSGeo GeoServer (MapServer), 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-30220 | OSGeo GeoServer: Improper Restriction of XML External Entity Reference | 9.9 | |
| Critical | CVE-2023-25157 | Unfiltered SQL Injection Vulnerabilities in Geoserver | 9.8 | |
| Critical | CVE-2023-43795 | WPS Server Side Request Forgery in GeoServer | 8.6 | |
| High | CVE-2021-40822 | OSGeo GeoServer: Server-Side Request Forgery (SSRF) | 7.5 | |
| High | CVE-2024-29198 | GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost | 7.5 | |
| High | CVE-2025-27511 | GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection | 7.2 | |
| High | CVE-2022-24847 | Improper Input Validation in GeoServer | 7.2 | |
| High | CVE-2025-52465 | GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page | 7.2 | |
| Medium | CVE-2025-27505 | GeoServer Missing Authorization on REST API Index | 5.3 | |
| High | CVE-2023-41339 | Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer | 8.6 | |
| High | CVE-2025-30145 | GeoServer has an Infinite Loop Vulnerability in Jiffle process | 7.5 | |
| Critical | CVE-2024-34711 | GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) | 9.3 | |
| Medium | CVE-2024-35230 | Welcome and About GeoServer pages communicate version and revision information | 5.3 | |
| High | CVE-2025-58175 | GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution | 6.5 | |
| High | CVE-2024-38524 | GWC Home Page communicate version and revision information | 5.3 | |
| Medium | CVE-2024-40625 | GeoServer Coverage REST API Allows Server Side Request Forgery | 5.5 |