GeoServer Zero-Day SQLi Exploited in the Wild Hours After Disclosure
A CVSS 9.8 SQLi in GeoServer's jsonArrayContains was exploited within hours of disclosure: watchTowr logged hundreds of probing attempts. On PostGIS deployments with admin SQL accounts it reaches RCE, and CVE-2023-25158-era mitigations don't help. Patched in GeoServer 3.0.1, 2.28.5, and 2.27.6.