Skip to content
OpenAdvisories

Package · Debian

mapserver

28 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-54355

    MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`

    MapServer is a system for developing web-based GIS applications. From 6.0 until 8.6.4, MapServer's OpenLayers HTML output for SERVICE=WMS&REQUEST=GetMap&FORMAT=application/openlayers reflects an attacker-controlled X-Forwarded-Host value received as HTTP_X_FO…

    MapServer MapServer mapserver mapserver Debian Ubuntu
  • Medium 6.1
    CVE-2026-42030

    MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer

    MapServer is a system for developing web-based GIS applications. From version 6.0 to before version 8.6.2, a reflected XSS vulnerability in MapServer's WMS server allows an unauthenticated attacker to inject arbitrary HTML/JavaScript into the browser of any u…

    MapServer MapServer mapserver mapserver Debian Ubuntu
  • Medium 5.3
    CVE-2026-33721

    MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing

    MapServer is a system for developing web-based GIS applications. Starting in version 4.2 and prior to version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD (Styled Layer Descriptor) parser lets a remote, unauthenticated attacker crash the MapServer p…

    MapServer MapServer mapserver mapserver Debian Ubuntu