MMapServer

Products

Exploited and recent CVEs

• CVE-2026-54355 Medium 5.3 MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST` 0.5%
• CVE-2026-54354 High 8.2 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation 0.7%
• CVE-2026-45104 High 7.5 MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` 0.3%
• CVE-2026-42030 Medium 6.1 MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer 0.2%
• CVE-2026-33721 Medium 5.3 MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing 1.2%
• CVE-2025-59431 High 8.9 MapServer - WFS XML Filter Query SQL injection 0.4%