org.apache.struts:struts2-core

CRITICAL 9.8

Maven KEV

CVE-2012-0391

Apache Struts Remote Java Code Execution

May 4, 2022

HIGH 8.1

Maven

CVE-2025-68493

Apache Struts 2 is Missing XML Validation

Jan 11, 2026

HIGH 8.2

Maven

CVE-2025-66675

Apache Struts has a Denial of Service vulnerability

Dec 10, 2025

HIGH 7.5

Maven

CVE-2025-64775

Apache Struts is Vulnerable to DoS via File Leak

Dec 1, 2025

HIGH 7.5

Maven

CVE-2023-41835

Apache Struts Improper Control of Dynamically-Managed Code Resources vulnerability

Dec 5, 2023

CRITICAL 9.8

Maven KEV

CVE-2013-2251

Code injection in Apache Struts

May 13, 2022

CRITICAL 9.8

Maven KEV

CVE-2020-17530

Remote code execution in Apache Struts

Feb 9, 2022

HIGH 8.1

Maven KEV

CVE-2018-11776

Apache Struts vulnerable to remote command execution (RCE) due to improper input validation

Oct 18, 2018

CRITICAL 10.0

Maven KEV

CVE-2017-5638

Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

Oct 18, 2018

HIGH 7.5

Maven

CVE-2023-34396

Apache Struts vulnerable to memory exhaustion

Jun 14, 2023

CRITICAL 9.8

Maven

CVE-2024-53677

Apache Struts file upload logic is flawed

Dec 11, 2024

HIGH 8.8

Maven

CVE-2016-4461

Apache Struts forced double OGNL evaluation

May 14, 2022

CRITICAL 9.8

Maven

CVE-2023-50164

Apache Struts vulnerable to path traversal

Dec 7, 2023

MEDIUM 6.5

Maven

CVE-2023-34149

Apache Struts vulnerable to memory exhaustion

Jun 14, 2023

UNKNOWN

Maven

CVE-2013-6348

Apache Struts is vulnerable to Cross-site Scripting

May 17, 2022

UNKNOWN

Maven

CVE-2013-4310

Apache Struts2 Broken Access Control Vulnerability

May 17, 2022

UNKNOWN

Maven

CVE-2012-4386

Cross-Site Request Forgery in Apache Struts

May 17, 2022

UNKNOWN

Maven

CVE-2013-2135

Arbitrary code execution in Apache Struts 2

May 14, 2022

UNKNOWN

Maven

CVE-2014-0116

ClassLoader manipulation in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2013-4316

Code injection in Apache Struts

May 17, 2022

UNKNOWN

Maven

CVE-2014-0112

ClassLoader manipulation in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2015-1831

Incomplete exclude pattern in Apache Struts

May 17, 2022

UNKNOWN

Maven

CVE-2013-2248

Open redirect in Apache Struts

May 17, 2022

UNKNOWN

Maven

CVE-2008-6682

Apache Struts is vulnerable to Cross-site Scripting

May 17, 2022

UNKNOWN

Maven

CVE-2014-0094

ClassLoader manipulation in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2008-6505

Apache Struts directory traversal vulnerability

May 17, 2022

UNKNOWN

Maven

CVE-2014-7809

Cross-Site Request Forgery in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2012-0838

Apache Struts Code injection due to conversion error

May 14, 2022

CRITICAL 9.8

Maven

CVE-2016-4436

Apache Struts improper action name cleanup

May 17, 2022

UNKNOWN

Maven

CVE-2012-0392

Apache Struts's CookieInterceptor component does not use the parameter-name whitelist

May 4, 2022

UNKNOWN

Maven

CVE-2013-1966

Arbitrary code execution in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2013-2134

Arbitrary code execution in Apache Struts 2

May 14, 2022

HIGH 7.5

Maven

CVE-2017-9787

Spring AOP functionality (Struts) vulnerable to DoS attack

Oct 16, 2018

UNKNOWN

Maven

CVE-2011-1772

Cross-site Scripting in Apache Struts

May 17, 2022

UNKNOWN

Maven

CVE-2014-0113

ClassLoader manipulation in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2015-2992

Cross-site Scripting in Apache Struts

May 24, 2022

UNKNOWN

Maven

CVE-2013-1965

Improper Control of Generation of Code in Apache Struts

May 14, 2022

UNKNOWN

Maven

CVE-2012-0393

Apache Struts's ParameterInterceptor component does not prevent access to public constructors

May 4, 2022

UNKNOWN

Maven

CVE-2010-1870

Server side object manipulation in Apache Struts

May 13, 2022

MEDIUM 5.3

Maven

CVE-2016-3093

Denial of service in Apache Struts

May 17, 2022

CRITICAL 9.8

Maven

CVE-2016-3087

Apache Struts vulnerable to arbitrary remote code execution due to improper input validation

May 14, 2022

CRITICAL 9.8

Maven

CVE-2021-31805

Expression Language Injection in Apache Struts

Apr 13, 2022

MEDIUM 5.9

Maven

CVE-2016-8738

Apache Struts vulnerable to possible DoS attack when using URLValidator

May 14, 2022

HIGH 7.5

Maven

CVE-2017-9804

Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used

Oct 16, 2018

MEDIUM 5.9

Maven

CVE-2017-7672

Apache Struts Improper Input Validation vulnerability

Oct 16, 2018

MEDIUM 6.1

Maven

CVE-2015-5169

Cross-site Scripting in Apache Struts

May 14, 2022

HIGH 7.5

Maven

CVE-2015-5209

Special top object can be used to access Struts' internals

May 14, 2022

CRITICAL 9.8

Maven

CVE-2011-3923

Struts ParameterInterceptor vulnerability allows remote command execution

Apr 22, 2022

CRITICAL 9.8

Maven

CVE-2016-3082

Remote Code Execution in Apache Struts

May 17, 2022

HIGH 8.8

Maven

CVE-2016-0785

Apache Struts RCE Vulnerability

May 14, 2022

CRITICAL 9.8

Maven

CVE-2016-4438

Arbitrary code execution in Apache Struts 2

May 14, 2022

MEDIUM 6.1

Maven

CVE-2016-4003

Cross-site Scripting in Apache Struts

May 14, 2022

MEDIUM 6.1

Maven

CVE-2016-2162

Apache Struts XSS Vulnerability

May 17, 2022

CRITICAL 9.8

Maven

CVE-2017-12611

Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal

Oct 16, 2018

HIGH 8.1

Maven

CVE-2016-3081

Apache Struts RCE Vulnerability

May 14, 2022

HIGH 8.1

Maven

CVE-2013-2115

Code injection in Apache Struts

May 13, 2022

MEDIUM 5.3

Maven

CVE-2016-4465

Apache Struts vulnerable to possible DoS attack when using URLValidator

May 17, 2022

HIGH 7.5

Maven

CVE-2019-0233

Improper Preservation of Permissions in Apache Struts

May 24, 2022

CRITICAL 9.8

Maven

CVE-2019-0230

Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts

Dec 2, 2021

HIGH 8.8

Maven

CVE-2012-1592

Unrestricted Upload of File with Dangerous Type in Apache Struts2

Apr 23, 2022