Actively exploited vulnerabilities affecting OSGeo products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-58360https://wildfortech.com/security#CVE-2025-58360GeoServer's WMS GetMap endpoint fails to properly restrict XML External Entity (XXE) references, meaning an attacker can craft a malicious XML request that causes the server to process external entities it shouldn't. This can expose sensitive files on the server, enable server-side request forgery, or potentially lead to data exfiltration — all without requiring authentication depending on how the endpoint is exposed. GeoServer is widely used in geospatial infrastructure, making this a high-value target.Thu, 11 Dec 2025 00:00:00 GMTOSGeoGeoServer