Skip to content
OpenAdvisories

Package · Debian

mapserver

28 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-54354

    MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

    MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter() treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata s…

    MapServer MapServer mapserver mapserver Debian Ubuntu
  • High 7.5
    CVE-2026-45104

    MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

    MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the …

    MapServer MapServer mapserver mapserver Debian Ubuntu
  • High 8.9
    CVE-2025-59431

    MapServer - WFS XML Filter Query SQL injection

    MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in …

    MapServer MapServer mapserver mapserver Debian Ubuntu