Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
struts vulnerabilities and exploits
(subscribe to this query)
5
CVSSv2
CVE-2008-6505
Multiple directory traversal vulnerabilities in Apache Struts 2.0.x prior to 2.0.12 and 2.1.x prior to 2.1.3 allow remote malicious users to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) ...
Apache Struts 2.0.6
Apache Struts 2.0.8
Apache Struts 2.0.9
Apache Struts 2.0.11
Apache Struts 2.0.11.1
Apache Struts 2.0.11.2
Apache Struts 2.1.2 Beta
1 EDB exploit
5.9
CVSSv3
CVE-2016-8738
In Apache Struts 2.5 up to and including 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
Apache Software Foundation Apache Struts
Apache Struts 2.5
Apache Struts 2.5.1
Apache Struts 2.5.2
Apache Struts 2.5.3
Apache Struts 2.5.4
Apache Struts 2.5.5
4.3
CVSSv2
CVE-2008-2025
Cross-site scripting (XSS) vulnerability in Apache Struts prior to 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, prior to 1.2.9-108.2 on SUSE openSUSE 10.3, prior to 1.2.9-198.2 on SUSE openSUSE 11.0, and prior to 1.2.9-162.163.2 on SUSE openSUSE 11.1 allows remote malicious ...
Apache Struts 1.0.2
Apache Struts 1.1
Apache Struts 1.2.4
Apache Struts 1.2.7
Apache Struts 1.2.8
4.3
CVSSv2
CVE-2008-6682
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x prior to 2.0.11.1 and 2.1.x prior to 2.1.1 allow remote malicious users to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the h...
Apache Struts 2.0.6
Apache Struts 2.0.8
Apache Struts 2.0.9
Apache Struts 2.0.11
Apache Struts 2.1
9.8
CVSSv3
CVE-2016-3087
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote malicious users to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
Apache Struts 2.3.20
Apache Struts 2.3.20.1
Apache Struts 2.3.24
Apache Struts 2.3.24.1
Apache Struts 2.3.28
2 EDB exploits
1 Github repository
7.5
CVSSv3
CVE-2017-9793
The REST Plugin in Apache Struts 2.1.x, 2.3.7 up to and including 2.3.33 and 2.5 up to and including 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Apache Software Foundation Apache Struts
Apache Struts 2.3.7
Apache Struts 2.3.8
Apache Struts 2.3.9
Apache Struts 2.3.10
Apache Struts 2.3.11
Apache Struts 2.3.12
Apache Struts 2.3.13
Apache Struts 2.3.14
Apache Struts 2.3.14.1
Apache Struts 2.3.14.2
Apache Struts 2.3.14.3
1 Article
7.5
CVSSv3
CVE-2017-9804
In Apache Struts 2.3.7 up to and including 2.3.33 and 2.5 up to and including 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing v...
Apache Software Foundation Apache Struts
Apache Struts 2.3.7
Apache Struts 2.3.8
Apache Struts 2.3.9
Apache Struts 2.3.10
Apache Struts 2.3.11
Apache Struts 2.3.12
Apache Struts 2.3.13
Apache Struts 2.3.14
Apache Struts 2.3.14.1
Apache Struts 2.3.14.2
Apache Struts 2.3.14.3
1 Github repository
1 Article
5
CVSSv2
CVE-2008-6504
ParametersInterceptor in OpenSymphony XWork 2.0.x prior to 2.0.6 and 2.1.x prior to 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote malicious users to execute Object-Graph Navigation ...
Opensymphony Xwork 2.0.0
Opensymphony Xwork 2.0.1
Opensymphony Xwork 2.0.2
Opensymphony Xwork 2.0.3
Opensymphony Xwork 2.0.4
Opensymphony Xwork 2.0.5
Opensymphony Xwork 2.1.0
Opensymphony Xwork 2.1.1
Apache Struts 2.0.0
Apache Struts 2.0.2
Apache Struts 2.0.3
Apache Struts 2.0.4
1 EDB exploit
4.3
CVSSv2
CVE-2012-1006
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote malicious users to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to st...
Apache Struts 2.0.14
Apache Struts 2.2.3
1 EDB exploit
6.1
CVSSv3
CVE-2015-2992
Apache Struts prior to 2.3.20 has a cross-site scripting (XSS) vulnerability.
Apache Software Foundation Apache Struts
Apache Struts
Preferred Score:
CVSSv3
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
CVE-2025-49820
firefox
net/http
CVE-2025-49816
konsole
file inclusion
CVE-2025-33053
theeventscalendar
CVE-2025-49822
CVE-2025-3052
XXE
HTML injection
CVE-2025-5959
Home
/
Search Results
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »