Known CVE
GeoServer - XML External Entity Injection
GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.
CVE-2025-58360
High2025CVSS 8.2CWE-611
cve2025 · geoserver · xxe · wms · vkev · kev
Verified scans run this check after you prove you own the site.
All known CVEsView the checks catalogNational Vulnerability Database
Scan a website