MA
Product
Mapserver
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 4Medium 2Low 0
Watch
Add Mapserver to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-59431 | 9.8 | Sep 19 | MapServer is a system for developing web-based GIS applications Affected: 8.4.0 |
| CVE-2017-5522 | 9.8 | Mar 15 | Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash)… Affected: through 6.0.5; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +18 more |
| CVE-2026-45104 | 7.5 | May 27 | MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` Affected: 6.4.0 before 8.6.3 |
| CVE-2026-33721 | 7.5 | Mar 27 | MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing Affected: 4.2.0 before 8.6.1 |
| CVE-2010-1678 | 7.5 | Oct 29 | Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing Affected: 5.6.0 before 5.6.5.-2; 5.2.0; 5.4.0 |
| CVE-2016-9839 | 7.5 | Dec 8 | In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails Affected: through 7.0.2 |
| CVE-2026-42030 | 6.1 | May 8 | MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer Affected: 6.0.0 before 8.6.2 |
| CVE-2021-32062 | 5.3 | May 6 | MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enforce the MS_MAP_NO_PATH and… Affected: before 7.0.8; 7.1.0 before 7.2.3; 7.3.0 before 7.4.5; 7.5.0 before 7.6.3 |
| CVE-2013-7262 | – | Jan 5 | SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to… Affected: through 6.4.0; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more |
| CVE-2011-2975 | – | Aug 1 | Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash)… Affected: through 6.0.0; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more |
| CVE-2011-2704 | – | Aug 1 | Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding Affected: through 4.10.6; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more |
| CVE-2011-2703 | – | Aug 1 | Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors… Affected: through 4.10.6; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more |
| CVE-2010-2540 | – | Aug 2 | mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which… Affected: through 4.10.5; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more |
| CVE-2010-2539 | – | Aug 2 | Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors… Affected: through 4.10.5; 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; +34 more |
| CVE-2009-2281 | – | Oct 23 | Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +34 more |
| CVE-2009-1177 | – | Mar 31 | Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectors Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
| CVE-2009-1176 | – | Mar 31 | mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
| CVE-2009-0843 | – | Mar 31 | The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files via a full pathname… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
| CVE-2009-0842 | – | Mar 31 | mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname in the map parameter, which triggers… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
| CVE-2009-0841 | – | Mar 31 | Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
| CVE-2009-0840 | – | Mar 31 | Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to have an unknown… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
| CVE-2009-0839 | – | Mar 31 | Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAME attribute, allows… Affected: 4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more |
Showing 22