Home

Description

GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper input sanitization. Attackers can exploit the WebStrings.srf endpoint by manipulating path traversal and injection parameters to access system files and execute malicious scripts.

PUBLISHED Reserved 2026-01-14 | Published 2026-01-15 | Updated 2026-01-16 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
MEDIUM: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

<= 5.3.3
affected

Credits

Ken 's1ngular1ty' Pyle finder

References

www.exploit-db.com/exploits/50211 (ExploitDB-50211) exploit

www.geovision.com.tw/cyber_security.php (GeoVision Cyber Security Page) product

www.vulncheck.com/...ision-geowebserver-local-file-inclusion (VulnCheck Advisory: GeoVision Geowebserver 5.3.3 - Local FIle Inclusion) third-party-advisory

cve.org (CVE-2021-47795)

nvd.nist.gov (CVE-2021-47795)

Download JSON