Known Exploited Vulnerabilities July 15, 2024 · CISA KEV Catalog

CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-36401 OSGeo
Related: CVE-2025-58360: OSGeo Geo Server Improper Restriction of XML External Entity Reference Vulnerability Known Exploited Vulnerabilities · Dec 11, 2025
CVE-2022-24816: OSGeo Geo Server JAI-EXT Code Injection Vulnerability Known Exploited Vulnerabilities · Jun 26, 2024
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026