{"vulnerability": "CVE-2023-25158", "sightings": [{"uuid": "90cba7df-d5d8-48b6-8115-43b5227a71be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3m4jermtfhn2a", "content": "", "creation_timestamp": "2025-10-31T21:02:44.972286Z"}, {"uuid": "409cadb6-b2d4-4beb-a44d-763c62927686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/4538", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2023\n\u63cf\u8ff0\uff1aGeoServer & GeoTools SQL Injection (CVE-2023-25157 & CVE-2023-25158)\nURL\uff1ahttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158\n\n\u6807\u7b7e\uff1a#CVE-2023", "creation_timestamp": "2023-06-11T20:22:50.000000Z"}, {"uuid": "55da205d-5bb8-44c2-9457-70b4d8bd69f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/LockBitChannels/51257", "content": "Instituto Argentino del Petr\u00f3leo y del Gas \n\nCVE: \n\nCVE-2023-25157\n\nTARGET: \n\nhttps://geopg.iapg.org.ar/geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=GeoPG:areasPrecarga&CQL_FILTER=strStartswith(obj_version,%27%27%27%27)=true\n\nEXPLOIT (POC):\n\nhttps://github.com/win3zz/CVE-2023-25157 \n\nINFO: \n\nhttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2024-09-25T14:32:29.000000Z"}, {"uuid": "35933e55-4fd2-40e1-9dba-b85b06cd7df1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/LockBitChannels/46741", "content": "Instituto Argentino del Petr\u00f3leo y del Gas \n\nCVE: \n\nCVE-2023-25157\n\nTARGET: \n\nhttps://geopg.iapg.org.ar/geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=GeoPG:areasPrecarga&CQL_FILTER=strStartswith(obj_version,%27%27%27%27)=true\n\nEXPLOIT (POC):\n\nhttps://github.com/win3zz/CVE-2023-25157 \n\nINFO: \n\nhttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2024-09-21T11:50:57.000000Z"}, {"uuid": "9c1eb344-1a09-4d33-b789-3802c9b57d60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/LockBitChannels/23073", "content": "Instituto Argentino del Petr\u00f3leo y del Gas \n\nCVE: \n\nCVE-2023-25157\n\nTARGET: \n\nhttps://geopg.iapg.org.ar/geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=GeoPG:areasPrecarga&CQL_FILTER=strStartswith(obj_version,%27%27%27%27)=true\n\nEXPLOIT (POC):\n\nhttps://github.com/win3zz/CVE-2023-25157 \n\nINFO: \n\nhttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2024-08-23T05:27:54.000000Z"}, {"uuid": "caa5de5b-397c-484d-bc23-6fa9d25e8ff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/LockBitChannels/86623", "content": "Instituto Argentino del Petr\u00f3leo y del Gas \n\nCVE: \n\nCVE-2023-25157\n\nTARGET: \n\nhttps://geopg.iapg.org.ar/geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=GeoPG:areasPrecarga&CQL_FILTER=strStartswith(obj_version,%27%27%27%27)=true\n\nEXPLOIT (POC):\n\nhttps://github.com/win3zz/CVE-2023-25157 \n\nINFO: \n\nhttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2024-08-23T05:27:52.000000Z"}, {"uuid": "f8db24f6-7cac-44d2-8b5a-0f6adaadd379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/LockBitChannels/114102", "content": "Instituto Argentino del Petr\u00f3leo y del Gas \n\nCVE: \n\nCVE-2023-25157\n\nTARGET: \n\nhttps://geopg.iapg.org.ar/geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=GeoPG:areasPrecarga&CQL_FILTER=strStartswith(obj_version,%27%27%27%27)=true\n\nEXPLOIT (POC):\n\nhttps://github.com/win3zz/CVE-2023-25157 \n\nINFO: \n\nhttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2024-09-25T14:32:27.000000Z"}, {"uuid": "d7a6f84f-268b-4a7d-b79b-f5bf0ea33e3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/97o8H92ysPogWiZPdtoiRG_yDzZCyat-wYa5JUnG0_YL0po", "content": "", "creation_timestamp": "2024-07-11T05:37:18.000000Z"}, {"uuid": "ffb211e7-6be2-4a1f-8a09-2818b231aa16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/IWS_vdKP8sgrY5gLgCPrkZk-LHS_2k9xWX1yT9cotUmlo2Uy", "content": "", "creation_timestamp": "2025-01-18T21:56:29.000000Z"}, {"uuid": "0ebf9ebf-08b8-4c3f-b936-abd109976466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/OEg8HrPyF37J-vNyvgAbgVfH1cND-LUmbo1w5fnZbA97NXU_", "content": "", "creation_timestamp": "2025-01-07T05:08:53.000000Z"}, {"uuid": "11471d47-ef75-4bb1-be91-6e0333abcacb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/1-fQEAf9zdZhP8U9JlfhshUKIf_oGTilQHlR5yefhegAE4Q", "content": "", "creation_timestamp": "2024-09-25T14:32:41.000000Z"}, {"uuid": "9e61c733-6bd7-42ef-a53a-5e384b33b0aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/cGZe9HOatBOpRYxdc_GFENPohKeQJpSX-0mFvbmC9TF0oFk", "content": "", "creation_timestamp": "2024-09-21T11:51:23.000000Z"}, {"uuid": "1e21448f-f75c-45c3-8dc7-50ea3e538af0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/gj93P2l6tR-CQpz0ZmAmr4u1uuySqvPbjtdUoITSQlSP_pI", "content": "", "creation_timestamp": "2024-08-23T05:27:58.000000Z"}, {"uuid": "24ea0b50-aca8-4d2f-bb7e-11038eeef5ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/8kuZMeQDWj_3Y_Wh_LQrqlGxyf7tVz7n1SRMvSXmlKlfrS8", "content": "", "creation_timestamp": "2024-07-11T05:37:18.000000Z"}, {"uuid": "1df3afc1-587f-40ff-873a-bf478e4c3a37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/ASDRpP9GiU4JO8pOjmGxmddBerQfe_KbWsxU6W9kHCoKk1U", "content": "", "creation_timestamp": "2024-08-23T05:27:59.000000Z"}, {"uuid": "f06c9dfb-a5bd-4dd6-b173-889a0c9f5f95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/IqdM5nvzs1brEdeE8cbCEB5Vhh4zS30-EIEq7TIjslasGuw", "content": "", "creation_timestamp": "2024-07-11T05:37:19.000000Z"}, {"uuid": "352eb423-3ae0-479b-8c5b-c04ba02e0c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/m7MxC6hm7ItAhposRvk8IiGwxjG9a9shiloiRAer3HT2F9U", "content": "", "creation_timestamp": "2024-09-25T14:32:41.000000Z"}, {"uuid": "adb2e729-b040-42c2-a86e-0ad290c7353b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/3no4dIg2k44AvUb6sgqwXmgAoKxKI2JtekpyDANlNcY6rY8", "content": "", "creation_timestamp": "2024-09-21T11:51:17.000000Z"}, {"uuid": "683a96ba-88c0-424e-92e7-ab84bb39ae4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/55DVCuR8w0IyLrTs3rzulkPBxgRxTIiTeJ7hyFYZ4WSp6gJI", "content": "", "creation_timestamp": "2025-01-13T01:03:08.000000Z"}, {"uuid": "4d6be71d-c961-4c03-90ab-b46b6296429f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/73P5n3sLX9SuBPcHTMorCEYvblMCOZyJ2AhQRHcKBTQ8fynE", "content": "", "creation_timestamp": "2024-12-20T09:39:30.000000Z"}, {"uuid": "fca6101e-c3b0-4fe2-95a9-48f4e63f6052", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/NRpQJui_QPN-VwWhVrsL5-YH0LXmaCMbhtvD462cnLE5yAgk", "content": "", "creation_timestamp": "2025-01-07T05:08:50.000000Z"}, {"uuid": "78a8a9be-47e5-4b1e-8123-156cfae95b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "Telegram/sI95sQqr7vmPeKfqrt4vEXMsY3f0wQ-hn7oUnpwK6uLzntML", "content": "", "creation_timestamp": "2025-01-18T21:56:31.000000Z"}, {"uuid": "ed55a845-c947-4713-8ba2-6410d66e8134", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/LockBitRaasRansomware/43294", "content": "Instituto Argentino del Petr\u00f3leo y del Gas \n\nCVE: \n\nCVE-2023-25157\n\nTARGET: \n\nhttps://geopg.iapg.org.ar/geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=GeoPG:areasPrecarga&CQL_FILTER=strStartswith(obj_version,%27%27%27%27)=true\n\nEXPLOIT (POC):\n\nhttps://github.com/win3zz/CVE-2023-25157 \n\nINFO: \n\nhttps://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2024-07-11T05:37:18.000000Z"}, {"uuid": "0c34bb18-e9ee-47e9-9ea3-a3c9d1c8c546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "seen", "source": "https://t.me/cibsecurity/58646", "content": "\u203c CVE-2023-25158 \u203c\n\nGeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-22T00:47:05.000000Z"}, {"uuid": "2e3c12fb-6ab0-42ff-a506-1e17238fd534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/14811", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#sql_injection\nName: *CVE-2023-25157-and-CVE-2023-25158*\nGithub: https://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2026-07-31T00:00:29.206313Z"}, {"uuid": "c3997168-c11d-401f-aaf7-8397c25afeb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-25158", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevato-sfruttamento-di-vulnerabilita-in-geoserver", "content": "", "creation_timestamp": "2026-08-18T12:45:07.927864Z"}, {"uuid": "35e360fa-89b3-49f7-acfb-63187e93db67", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/027ad2e9-5a25-46e2-aad6-dc6c8c7d41a5", "content": "", "creation_timestamp": "2026-08-21T01:02:47.470529Z"}, {"uuid": "a530806f-4ffc-4704-bdf1-d0b2f369fe60", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a1df9fe0-39f9-4ba8-a3d5-f8e4ab0beae9", "content": "", "creation_timestamp": "2026-08-20T11:00:22.573482Z"}, {"uuid": "84c1ce64-c507-4856-a670-a33cbc011faa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-21)", "content": "", "creation_timestamp": "2026-08-22T10:00:16.023836Z"}, {"uuid": "5c331968-19c3-44c1-a2fc-8fe4254cc91d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "exploited", "source": "https://t.me/thehackernews/9812", "content": "\u26a1 UPDATE: GeoServer has patched the actively targeted SQL injection flaw.\n\nThe issue affects PostGIS-backed deployments and is a regression of CVE-2023-25158.\n\nUpdate now: https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html", "creation_timestamp": "2026-08-15T17:00:04.357326Z"}, {"uuid": "076ad372-78d1-4090-b24a-ef46daa86210", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-21)", "content": "", "creation_timestamp": "2026-08-22T10:15:08.389028Z"}, {"uuid": "4e9130ba-09ac-4dd3-9afa-1cd2ae5bb6be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "exploited", "source": "https://t.me/thehackernews/9812", "content": "\u26a1 UPDATE: GeoServer has patched the actively targeted SQL injection flaw.\n\nThe issue affects PostGIS-backed deployments and is a regression of CVE-2023-25158.\n\nUpdate now: https://thehackernews.com/2026/08/unpatched-geoserver-zero-day-targeted.html", "creation_timestamp": "2026-08-16T00:00:21.079866Z"}, {"uuid": "cefb600c-7f74-4888-812a-c57a7dee64b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "seen", "source": "https://t.me/CVEhub/14811", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#sql_injection\nName: *CVE-2023-25157-and-CVE-2023-25158*\nGithub: https://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2026-07-29T12:00:25.125329Z"}, {"uuid": "3fc32dff-146b-4d67-b40b-5260b5b670fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-25158", "type": "seen", "source": "https://t.me/CVEhub/14811", "content": "\ud83d\udc7eKEYWORD SERVICE \ud83c\udff7#sql_injection\nName: *CVE-2023-25157-and-CVE-2023-25158*\nGithub: https://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158", "creation_timestamp": "2026-07-30T00:00:46.048927Z"}]}