ST
Web Framework
Struts
On CISA KEVExploited in the wildRansomware-linked
99
CVEs
9
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 17High 32Medium 14Low 0
Watch
Add Struts to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104713 | 6.5 | Oct 5 | Apache Struts: Unbounded request body read in the REST plugin Affected: 2.1.8 through 2.3.37; 2.5.0 through 2.5.33; 6.0.0 through 6.11.0; 7.0.0 through 7.3.0 |
| CVE-2023-34149 | 6.5 | Jun 14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2 Affected: before 2.5.31; 6.0.0 before 6.1.2.1 |
| CVE-2017-15707 | 6.2 | Dec 1 | In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially… Affected: 2.5 through 2.5.14 |
| CVE-2015-2992 | 6.1 | Feb 27 | Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability Affected: 2.0.0 before 2.3.20 |
| CVE-2015-5169 | 6.1 | Sep 25 | Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20 Affected: 2.0.0 through 2.3.16.3 |
| CVE-2016-4003 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows… Affected: 2.0.0 through 2.3.24.1 |
| CVE-2016-2162 | 6.1 | Apr 12 | Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2016-8738 | 5.9 | Sep 20 | In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which… Affected: 2.5; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5 |
| CVE-2017-7672 | 5.9 | Jul 13 | If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when… Affected: 2.5; 2.5.1; 2.5.2; 2.5.5; 2.5.8; 2.5.10; +1 more |
| CVE-2016-4465 | 5.3 | Jul 4 | The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field Affected: 2.3.20; 2.3.20.1; 2.3.20.3; 2.3.24; 2.3.24.1; 2.3.24.3; +6 more |
| CVE-2016-3093 | 5.3 | Jun 7 | Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2026-73632 | 4.3 | Aug 15 | Apache Struts: Shared serialization state in the JSON plugin Affected: 7.2.1 |
| CVE-2026-73631 | 4.3 | Aug 15 | Apache Struts: Shared parsing state in the JSON plugin Affected: 7.2.1 |
| CVE-2015-1831 | – | Jul 16 | The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors Affected: 2.3.20 |
| CVE-2014-7809 | – | Dec 10 | Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2014-0116 | – | May 8 | CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2014-0114 | – | Apr 30 | Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2,… Affected: 1.0; 1.0.2; 1.1; 1.1; 1.1; 1.1; +11 more |
| CVE-2014-0113 | – | Apr 29 | CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote… Affected: 2.0.0 before 2.3.16.2 |
| CVE-2014-0112 | – | Apr 29 | ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and… Affected: 2.0.0 before 2.3.16.2 |
| CVE-2014-0094 | – | Mar 11 | The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method Affected: 2.0.0 before 2.3.16.1 |
| CVE-2013-6348 | – | Nov 2 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1)… Affected: 2.3.15.3 |
| CVE-2013-4316 | – | Sep 30 | Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2013-4310 | – | Sep 30 | Apache Struts 2.0.0 through 2.3.15.1 allows remote attackers to bypass access controls via a crafted action: prefix Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2013-2248 | – | Jul 20 | Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2013-2135 | – | Jul 16 | Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which… Affected: 2.0.0 before 2.3.14.3 |
| CVE-2013-2134 | – | Jul 16 | Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard… Affected: 2.0.0 before 2.3.14.3 |
| CVE-2013-1966 | – | Jul 10 | Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in… Affected: 2.0.0 before 2.3.14.1 |
| CVE-2013-1965 | – | Jul 10 | Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is… Affected: 2.0.0 before 2.3.14.1 |
| CVE-2012-4387 | – | Sep 5 | Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +29 more |
| CVE-2012-4386 | – | Sep 5 | The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +29 more |
| CVE-2012-0838 | – | Mar 2 | Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values,… Affected: 2.0.0 through 2.2.3 |
| CVE-2012-1007 | – | Feb 7 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to… Affected: 1.3.10 |
| CVE-2012-1006 | – | Feb 7 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2)… Affected: 2.0.14; 2.2.3 |
| CVE-2011-5057 | – | Jan 8 | Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might… Affected: 2.0.0 before 2.3.3 |
| CVE-2012-0394 | – | Jan 8 | The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors Affected: 2.0.0 through 2.3.17 |
| CVE-2012-0393 | – | Jan 8 | The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary… Affected: 2.1.0 before 2.3.1.1 |
| CVE-2012-0392 | – | Jan 8 | The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a… Affected: 2.0.0 before 2.3.1 |
| CVE-2011-2088 | – | May 13 | XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class… Affected: 2.2.1 |
| CVE-2011-2087 | – | May 13 | Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +22 more |
| CVE-2011-1772 | – | May 13 | Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +22 more |
| CVE-2010-1870 | – | Aug 17 | The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +20 more |
| CVE-2008-6682 | – | Apr 9 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via… Affected: 2.0.6; 2.0.8; 2.0.9; 2.0.11; 2.1 |
| CVE-2008-2025 | – | Apr 9 | Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUSE openSUSE 10.3, before 1.2.9-198.2 on… Affected: 1.0.2; 1.1; 1.2.4; 1.2.7; 1.2.8 |
| CVE-2007-6726 | – | Apr 9 | Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or… Affected: 2.0.9 |
| CVE-2008-6505 | – | Mar 23 | Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot… Affected: 2.0.6; 2.0.8; 2.0.9; 2.0.11; 2.0.11.1; 2.0.11.2; +1 more |
| CVE-2008-6504 | – | Mar 23 | ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign)… Affected: 2.0.0; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6; +6 more |
| CVE-2006-1548 | – | Mar 30 | Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before… Affected: through 1.2.8 |
| CVE-2006-1546 | – | Mar 30 | Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter,… Affected: through 1.2.8 |
| CVE-2005-3745 | – | Nov 22 | Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string,… Affected: 1.2.7 |