CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.

• CWE-79

• https://github.com/maptiler/tileserver-php/issues/167Exploit, Issue Tracking
• https://github.com/mheranco/CVE-2025-44136Exploit

Published

Jul 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-44110FluxBB 1.5.11 is vulnerable to Cross Site Scripting (XSS) in…5.4
• CVE-2025-44115A vulnerability has been found in Cotonti Siena v0.9.25. Aff…5.4
• CVE-2025-4412On macOS systems, by utilizing a Launch Agent and loading th…4.8
• CVE-2025-4413The Pixabay Images plugin for WordPress is vulnerable to arb…8.8
• CVE-2025-44134A vulnerability was found in Code-Projects Online Class and …6.5
• CVE-2025-44135A vulnerability was found in code-projects Online Class and …6.5
• CVE-2025-44137MapTiler Tileserver-php v2.0 is vulnerable to Directory Trav…8.2
• CVE-2025-44139Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of Fil…7.2
• CVE-2025-4414Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2025-44141A Cross-Site Scripting (XSS) vulnerability exists in the nod…6.1
• CVE-2025-44148Cross Site Scripting (XSS) vulnerability in MailEnable befor…9.8
• CVE-2025-4415Improper Neutralization of Input During Web Page Generation …4.8