A critical zero-day vulnerability in GeoServer is being actively exploited by hackers. The SQL injection flaw could enable attackers to achieve remote code execution on vulnerable systems.