Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
GeoServer Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability - CVE-2025-27511 - Vulnerability Database
GeoServer

GeoServer Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability - CVE-2025-27511

High
Reference: CVE-2025-27511
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-27511
Title: GeoServer Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability
Overview:

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.