Geotools
Monthly
SQL injection in the GeoTools Java geospatial library (gt-jdbc-postgis module) lets remote unauthenticated attackers execute arbitrary SQL against PostGIS-backed layers via the OGC Filter jsonArrayContains function. Affected builds run from 30.5 up to the fixed 33.6, 34.5, and 35.1 releases, where the function's value argument is written into generated SQL without escaping. No active exploitation is listed in CISA KEV and no public exploit is identified, though the upstream fix commit and regression tests publicly demonstrate the injection payload structure.
GeoServer is an open source server that allows users to share and edit geospatial data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Vendor patch is available.
GeoTools is an open source Java library that provides tools for geospatial data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GeoTools is an open source Java library that provides tools for geospatial data. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
SQL injection in the GeoTools Java geospatial library (gt-jdbc-postgis module) lets remote unauthenticated attackers execute arbitrary SQL against PostGIS-backed layers via the OGC Filter jsonArrayContains function. Affected builds run from 30.5 up to the fixed 33.6, 34.5, and 35.1 releases, where the function's value argument is written into generated SQL without escaping. No active exploitation is listed in CISA KEV and no public exploit is identified, though the upstream fix commit and regression tests publicly demonstrate the injection payload structure.
GeoServer is an open source server that allows users to share and edit geospatial data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Vendor patch is available.
GeoTools is an open source Java library that provides tools for geospatial data. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.
GeoTools is an open source Java library that provides tools for geospatial data. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.