Description
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.
Remediation
References
Related Vulnerabilities
WordPress Plugin Gmedia Photo Gallery Multiple Vulnerabilities (1.6.4)
WordPress Plugin YITH WooCommerce Product Add-Ons Multiple Vulnerabilities (2.0.7)
WordPress Plugin Slimstat Analytics Cross-Site Scripting (5.0.4)
WordPress Plugin Jigoshop-Store Toolkit Privilege Escalation (1.3.8)
WordPress Plugin WP Live.php 's' Parameter Cross-Site Scripting (1.2.1)