CVE-2025-59431highCWE-89

CVE-2025-59431: falha de alta gravidade em MapServer

MapServer - WFS XML Filter Query SQL injection

Publicada em

Seguir esta CVE+ Monitorar MapServer+ Monitorar mapserver

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.9epss 0.4%
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipulate backend database queries. This vulnerability is fixed in 8.4.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
MapServer · MapServer
CVEs relacionadas — MapServer

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33721MEDIUMMapServer has heap buffer overflow in SLD `Categorize` Threshold parsingEPSS 1.2%CVE-2026-54354HIGHMapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query TranslationEPSS 0.7%CVE-2026-54355MEDIUMMapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`EPSS 0.5%CVE-2026-45104HIGHMapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`EPSS 0.3%CVE-2026-42030MEDIUMMapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewerEPSS 0.2%