name_reverser

== 欢迎使用 Rails Rails 是一个 Web 应用框架，包含了一切根据模型-视图-控制（Model-View-Control）模式创建数据库驱动 Web 应用所需的内容。 该模式将视图（也称为表示层）拆分为“哑”模板，主要负责在 HTML 标签之间插入预构建的数据。模型包含“智能”领域对象（如 Account、Product、Person、Post），这些对象拥有所有业务逻辑，并知道如何将自身持久化到数据库。控制器通过操作模型并将数据导向视图来处理传入的请求（如 Save New Account、Update Product、Show Post）。 在 Rails 中，模型由名...

dawnscanner

Dawnscanner - 针对 Ruby Web 应用的安全扫描器 dawn 是一款源代码扫描器，旨在检查您的 Web 应用是否存在安全问题。 该工具能够扫描用 Ruby 编写的 Web 应用，并默认支持所有主流 MVC（模型 - 视图 - 控制器）框架： Ruby on Rails Sinatra Padrino dawn 2.0 版本的知识库中包含了 680 多项安全检查，这些检查每周会根据 NIST 的国家漏洞数据库进行更新。 简要工作原理 当您在代码上运行 dawn 时，它会解析您的项目 Gemfile.lock 文件，查找所使用的 gem，并尝试检测您正在使用的 Ruby...

dawnscanner

Dawnscanner - The raising security scanner for ruby web applications dawn is a source code scanner designed to review your web applications for security issues. The tool is able to scan web applications written in Ruby and it supports all major MVC Model View Controller frameworks, out of the box...

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

CLEANSTART-2026-IL27901 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

cve-2023-34035-mitigations

此仓库是一组示例，用于演示应用程序可能受到 https://spring.io/security/cve-2023-34035CVE-2023-34035 影响的情况。 当以下所有条件都成立时，应用程序存在漏洞： Spring MVC 在 classpath 上 DispatcherServlet 和至少一个其他 Servlet 被映射；其中一个具有基于路径的 Servlet 映射（例如 /path/） 应用程序使用 requestMatchersString 来引用其 Servlet 映射形式为 /path/ 的端点 == 示例 这里有使用 Spring Boot 和不使用 Sprin...

CVE-2022-22965

Spring4Shell 漏洞 - CVE-2022-22965 📕 介绍 spring4shell 漏洞之所以如此命名，是因为在 2022 年初发现了 2 个并被攻击者广泛利用的漏洞。其中一个漏洞位于名为 "Spring Cloud Functions" 的框架组件中（不太严重），第二个更关键的组件位于框架核心，称为 "Spring Core"。由于这两个关键漏洞，社区开了一个玩笑，将其与 2021 年披露的另一个关键漏洞 Log4shell 联系起来。 它是如何工作的？ Spring MVC...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell 免责声明： 本仓库仅供教育和研究目的 使用。 所有利用脚本必须仅针对您拥有或已获得明确书面授权测试的系统。作者不对因使用本材料造成的任何滥用或损害负责。 针对 CVE-2022-22965 的研究与概念验证，这是一个于 2022 年 4 月公开披露的严重 Spring Framework 远程代码执行（RCE）漏洞。 漏洞概述 Spring4Shell 影响 Spring MVC 和 Spring WebFlux 应用程序，当以下所有条件同时满足时： 条件| 值 ---|--- JDK 版本| 9 或更高 应用服务器|...

CLEANSTART-2026-ZG60550 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the rundeck package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-SC51338 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-WP23886 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

CLEANSTART-2026-XW09106 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the rundeck package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-GO94409 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the rundeck package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

Security Bulletin: As an Spring MVC application, IBM Sterling Control Center is vulnerable to Path Traversal, Open Redirect and CRLF Injection (CVE-2026-47884, CVE-2026-47887, CVE-2026-47890)

Summary Spring MVC framework is used by IBM Sterling Control Center and as part of dependency one of them is in spring-webmvc-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an...

ROOT-APP-MAVEN-CVE-2026-22745 CVE-2026-22745 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22745 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

apache-struts-cve-2017-9805

Apache Struts Web框架 Apache Struts Web框架是一个免费的开源解决方案，用于创建Java Web应用程序。 Web应用程序与传统网站的不同之处在于，Web应用程序可以创建动态响应。许多网站仅提供静态页面。Web应用程序可以与数据库和业务逻辑引擎交互以定制响应。 基于JavaServer Pages的Web应用程序有时会混杂数据库代码、页面设计代码和控制流代码。在实践中，我们发现除非将这些关注点分离，否则较大的应用程序将难以维护。...

CVE-2026-47883

CVE-2026-47883: PoC de Open Redirect en UrlHandlerFilter de Spring Framework Este repositorio es un PoC de reproducción mínima de CVE-2026-47883, publicado a través del aviso de seguridad oficial de Spring. Aviso oficial: https://spring.io/security/cve-2026-47883/ Título oficial: Spring Framework...

spring-RCE-CVE-2022-22965

漏洞简介 最近spring爆出重磅级CVE漏洞，cve信息显示"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot...