What’s Vulnerable › Products

MapServer vulnerabilities

24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your MapServer version is affected

Latest MapServer vulnerabilities

• CVE-2026-54355 — MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST` (CVSS 5.3)
• CVE-2026-54354 — MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation (CVSS 8.2)
• CVE-2026-45104 — MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY` (CVSS 7.5)
• CVE-2026-42030 — MapServer: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OpenLayers viewer (CVSS 6.1)
• CVE-2026-33721 — MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing (CVSS 7.5)
• CVE-2025-59431 — MapServer - WFS XML Filter Query SQL injection (CVSS 9.8)
• CVE-2021-32062 — (CVSS 5.3)
• CVE-2010-1678 — (CVSS 7.5)
• CVE-2017-5522 — (CVSS 9.8)
• CVE-2016-9839 — (CVSS 7.5)
• CVE-2013-7262 — (CVSS 6.8)
• CVE-2011-2975 — (CVSS 6.8)
• CVE-2011-2704 — (CVSS 7.5)
• CVE-2011-2703 — (CVSS 7.5)
• CVE-2010-2540 — (CVSS 10.0)
• CVE-2010-2539 — (CVSS 2.1)
• CVE-2009-2281 — (CVSS 10.0)
• CVE-2009-1177 — (CVSS 10.0)
• CVE-2009-1176 — (CVSS 10.0)
• CVE-2009-0843 — (CVSS 7.8)
• CVE-2009-0842 — (CVSS 4.3)
• CVE-2009-0841 — (CVSS 10.0)
• CVE-2009-0840 — (CVSS 10.0)
• CVE-2009-0839 — (CVSS 10.0)