# cve.now: Geoserver

The newest entries naming Geoserver as an affected vendor (up to 200), of 31 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-58175](https://cve.now/CVE-2025-58175.md): GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution (CVSS 6.5)
- [CVE-2025-52465](https://cve.now/CVE-2025-52465.md): GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page (CVSS 7.2)
- [CVE-2025-27511](https://cve.now/CVE-2025-27511.md): GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection (CVSS 7.2)
- [CVE-2025-21621](https://cve.now/CVE-2025-21621.md): GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format (CVSS 6.1)
- [CVE-2025-58360](https://cve.now/CVE-2025-58360.md): GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature (CVSS 8.2, KEV)
- [CVE-2025-30220](https://cve.now/CVE-2025-30220.md): GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling (CVSS 9.9)
- [CVE-2025-30145](https://cve.now/CVE-2025-30145.md): GeoServer has an Infinite Loop Vulnerability in Jiffle process (CVSS 7.5)
- [CVE-2025-27505](https://cve.now/CVE-2025-27505.md): GeoServer Missing Authorization on REST API Index (CVSS 5.3)
- [CVE-2024-40625](https://cve.now/CVE-2024-40625.md): GeoServer Coverage REST API Allows Server Side Request Forgery (CVSS 5.5)
- [CVE-2024-38524](https://cve.now/CVE-2024-38524.md): GWC Home Page communicate version and revision information (CVSS 5.3)
- [CVE-2024-34711](https://cve.now/CVE-2024-34711.md): GeoServer has improper ENTITY\_RESOLUTION\_ALLOWLIST URI validation in XML Processing (SSRF) (CVSS 9.3)
- [CVE-2024-29198](https://cve.now/CVE-2024-29198.md): GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost (CVSS 7.5)
- [CVE-2024-35230](https://cve.now/CVE-2024-35230.md): Welcome and About GeoServer pages communicate version and revision information (CVSS 5.3)
- [CVE-2024-36401](https://cve.now/CVE-2024-36401.md): Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver (CVSS 9.8, KEV)
- [CVE-2024-34696](https://cve.now/CVE-2024-34696.md): GeoServer's Server Status shows sensitive environmental variables and Java properties (CVSS 4.5)
- [CVE-2024-24749](https://cve.now/CVE-2024-24749.md): Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat (CVSS 7.5)
- [CVE-2024-23821](https://cve.now/CVE-2024-23821.md): GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) (CVSS 4.8)
- [CVE-2024-23819](https://cve.now/CVE-2024-23819.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page (CVSS 4.8)
- [CVE-2024-23818](https://cve.now/CVE-2024-23818.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format (CVSS 4.8)
- [CVE-2024-23643](https://cve.now/CVE-2024-23643.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form (CVSS 4.8)
- [CVE-2024-23642](https://cve.now/CVE-2024-23642.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer (CVSS 4.8)
- [CVE-2024-23640](https://cve.now/CVE-2024-23640.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher (CVSS 4.8)
- [CVE-2024-23634](https://cve.now/CVE-2024-23634.md): GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API (CVSS 6.0)
- [CVE-2023-51445](https://cve.now/CVE-2023-51445.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API (CVSS 4.8)
- [CVE-2023-51444](https://cve.now/CVE-2023-51444.md): GeoServer arbitrary file upload vulnerability in REST Coverage Store API (CVSS 7.2)
- [CVE-2023-41877](https://cve.now/CVE-2023-41877.md): GeoServer log file path traversal vulnerability (CVSS 7.2)
- [CVE-2023-5786](https://cve.now/CVE-2023-5786.md): GeoServer GeoWebCache rest.html direct request (CVSS 5.3)
- [CVE-2023-43795](https://cve.now/CVE-2023-43795.md): WPS Server Side Request Forgery in GeoServer (CVSS 8.6)
- [CVE-2023-41339](https://cve.now/CVE-2023-41339.md): Unsecured WMS dynamic styling sld=\<url\> parameter affords blind unauthenticated SSRF in GeoServer (CVSS 8.6)
- [CVE-2023-25157](https://cve.now/CVE-2023-25157.md): Unfiltered SQL Injection Vulnerabilities in Geoserver (CVSS 9.8)
- [CVE-2022-24847](https://cve.now/CVE-2022-24847.md): Improper Input Validation in GeoServer (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/geoserver
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.