Junglewise Threat Intelligence

CVE-2025-21621: GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format

CVE-2025-21621 · Severity: low · CVSS 3.1 · Published 2025-11-25

Technologies: org.geoserver.web:gs-web-app (Maven). Vendors: Maven.

Executive brief

GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format

Affected products

  • Maven org.geoserver:gs-wms
  • Maven org.geoserver.web:gs-web-app

Related threats