{"action":"Upgrade org.geoserver:gs-wms to 2.25.0 or later.","affected":[{"fixed":"2.25.0","introduced":"0"}],"component":"org.geoserver:gs-wms","cve_ids":["CVE-2025-21621"],"ecosystem":"Maven","epss":0.00317,"exploited":false,"fixed_versions":["2.25.0"],"ghsa_id":"GHSA-w66h-j855-qr72","id":"tcs_01M5N9FPT50FKSZPQZT35VED7B","modified_at":"2025-11-27T09:16:28.004455Z","published_at":"2025-11-25T18:41:53Z","references":["https://osv.dev/vulnerability/GHSA-w66h-j855-qr72","https://github.com/geoserver/geoserver/security/advisories/GHSA-w66h-j855-qr72","https://nvd.nist.gov/vuln/detail/CVE-2025-21621","https://github.com/geoserver/geoserver/pull/7406","https://github.com/geoserver/geoserver/commit/dc9ff1c726dd73c884437a123b4ad72b19383c7d","https://github.com/geoserver/geoserver","https://osgeo-org.atlassian.net/browse/GEOS-11203","https://osgeo-org.atlassian.net/browse/GEOS-11297"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-w66h-j855-qr72#Maven/org.geoserver:gs-wms","url":"https://osv.dev/vulnerability/GHSA-w66h-j855-qr72"}],"summary":"GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format"}