by Kastro
Paper/Archive/CVE-2025-44136

CVE-2025-44136

mitre — MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS).

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 86.0.860 × 2017.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/maptiler/tileserver-php/issues/167refgithub.com/mheranco/CVE-2025-44136