CVE-2025-44136

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.

9.8

CVSS

2.5%

EPSS (exploit prob.)

84th

EPSS percentile

2025-07-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
maptiler	tileserver_php	2.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/maptiler/tileserver-php/issues/167
https://github.com/mheranco/CVE-2025-44136

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-44136