Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
GeoServer Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2025-27511) - Vulnerability Database

GeoServer Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2025-27511)

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.

References

CVE-2025-27511

Related Vulnerabilities

MySQL CVE-2022-21611 Vulnerability (CVE-2022-21611) Medium
Common tags: Missing Update Known Vulnerabilities
Jenkins Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2020-2102) Medium
Common tags: Missing Update Known Vulnerabilities
Atlassian Confluence CVE-2020-29448 Vulnerability (CVE-2020-29448) Medium
Common tags: Missing Update Known Vulnerabilities
Atlassian Confluence Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-29450) Medium
Common tags: Missing Update Known Vulnerabilities
Atlassian Jira CVE-2020-29451 Vulnerability (CVE-2020-29451) Medium
Common tags: Missing Update Known Vulnerabilities

Severity

High

Classification

CVE-2025-27511
CWE-138
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update
Known Vulnerabilities