WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Product: Struts✕
Overview 7 matches · 0 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
7matches 0protected0.0% 2exploited28.6% 0CISA KEV0.0% 3public PoC42.9% 3EPSS ≥ 0.542.9%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 42.9% No exploit published 4 57.1%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 28.6% Working exploit published 1 14.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 4 57.1%
split by peak 4 / year
No exploit published: 4Mitigation candidate: 3 Critical: 7 not blocked: 7 No public exploit: 4Working exploit published: 1Exploited: 2
20164 Mitigation candidate1 No exploit published3 Critical4 not blocked4 Working exploit published1 No public exploit3 20170 20180 20191 Mitigation candidate1 Critical1 not blocked1 Exploited1 20200 20210 20220 20231 Mitigation candidate1 Critical1 not blocked1 Exploited1 20240 20250 20261 No exploit published1 Critical1 not blocked1 No public exploit1
20162017201820192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-104711 Critical 2026-10-05 No exploit published No public exploit Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected. This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0. Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
CVE-2023-50164 Critical 2023-12-07 Mitigation candidate Exploited An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
CVE-2011-3923 Critical 2019-11-01 Mitigation candidate Exploited Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2016-4436 Critical 2016-10-03 No exploit published No public exploit Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
CVE-2016-4438 Critical 2016-07-04 No exploit published No public exploit The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
CVE-2016-3087 Critical 2016-06-07 Mitigation candidate Working exploit published Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2016-3082 Critical 2016-04-26 No exploit published No public exploit XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.