CVE-2025-44136
CRITICALCVSS v3
9.8
CRITICAL
EPSS Score
13.0%
exploit probability
CISA KEV
No
known exploited
Exploitation
poc
SSVC status
Description
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
Technical Details
- CVSS v3 Vector
- 3.1
- Published
- 7/29/2025
- Last Modified
- 8/6/2025
Frequently Asked Questions
What is CVE-2025-44136?
MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.
Is CVE-2025-44136 actively exploited?
A proof-of-concept exploit exists for CVE-2025-44136, but active exploitation has not been confirmed at this time.
What is the CVSS score for CVE-2025-44136?
CVE-2025-44136 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string 3.1.
Is CVE-2025-44136 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.