cve-2023-34035-mitigations

此仓库是一组示例，用于演示应用程序可能受到 https://spring.io/security/cve-2023-34035CVE-2023-34035 影响的情况。 当以下所有条件都成立时，应用程序存在漏洞： Spring MVC 在 classpath 上 DispatcherServlet 和至少一个其他 Servlet 被映射；其中一个具有基于路径的 Servlet 映射（例如 /path/） 应用程序使用 requestMatchersString 来引用其 Servlet 映射形式为 /path/ 的端点 == 示例 这里有使用 Spring Boot 和不使用 Sprin...

apache-struts-cve-2017-9805

El framework web Apache Struts El framework web Apache Struts es una solución gratuita de código abierto para crear aplicaciones web Java. Las aplicaciones web se diferencian de los sitios web convencionales en que las aplicaciones web pueden crear una respuesta dinámica. Muchos sitios web entreg...

dawnscanner

Dawnscanner - 针对 Ruby Web 应用的安全扫描器 dawn 是一款源代码扫描器，旨在检查您的 Web 应用是否存在安全问题。 该工具能够扫描用 Ruby 编写的 Web 应用，并默认支持所有主流 MVC（模型 - 视图 - 控制器）框架： Ruby on Rails Sinatra Padrino dawn 2.0 版本的知识库中包含了 680 多项安全检查，这些检查每周会根据 NIST 的国家漏洞数据库进行更新。 简要工作原理 当您在代码上运行 dawn 时，它会解析您的项目 Gemfile.lock 文件，查找所使用的 gem，并尝试检测您正在使用的 Ruby...

dawnscanner

Dawnscanner - The raising security scanner for ruby web applications dawn is a source code scanner designed to review your web applications for security issues. The tool is able to scan web applications written in Ruby and it supports all major MVC Model View Controller frameworks, out of the box...

spring-RCE-CVE-2022-22965

Resumen de la vulnerabilidad Recientemente Spring ha publicado una vulnerabilidad CVE de gran repercusión. La información del CVE indica: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires th...

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

CVE-2022-22965

Spring4Shell 漏洞 - CVE-2022-22965 📕 介绍 spring4shell 漏洞之所以如此命名，是因为在 2022 年初发现了 2 个并被攻击者广泛利用的漏洞。其中一个漏洞位于名为 "Spring Cloud Functions" 的框架组件中（不太严重），第二个更关键的组件位于框架核心，称为 "Spring Core"。由于这两个关键漏洞，社区开了一个玩笑，将其与 2021 年披露的另一个关键漏洞 Log4shell 联系起来。 它是如何工作的？ Spring MVC...

name_reverser

== 欢迎使用 Rails Rails 是一个 Web 应用框架，包含了一切根据模型-视图-控制（Model-View-Control）模式创建数据库驱动 Web 应用所需的内容。 该模式将视图（也称为表示层）拆分为“哑”模板，主要负责在 HTML 标签之间插入预构建的数据。模型包含“智能”领域对象（如 Account、Product、Person、Post），这些对象拥有所有业务逻辑，并知道如何将自身持久化到数据库。控制器通过操作模型并将数据导向视图来处理传入的请求（如 Save New Account、Update Product、Show Post）。 在 Rails 中，模型由名...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell 免责声明： 本仓库仅供教育和研究目的 使用。 所有利用脚本必须仅针对您拥有或已获得明确书面授权测试的系统。作者不对因使用本材料造成的任何滥用或损害负责。 针对 CVE-2022-22965 的研究与概念验证，这是一个于 2022 年 4 月公开披露的严重 Spring Framework 远程代码执行（RCE）漏洞。 漏洞概述 Spring4Shell 影响 Spring MVC 和 Spring WebFlux 应用程序，当以下所有条件同时满足时： 条件| 值 ---|--- JDK 版本| 9 或更高 应用服务器|...

ROOT-APP-MAVEN-CVE-2026-22745 CVE-2026-22745 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-22745 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

CVE-2026-47883

CVE-2026-47883: PoC de Open Redirect en UrlHandlerFilter de Spring Framework Este repositorio es un PoC de reproducción mínima de CVE-2026-47883, publicado a través del aviso de seguridad oficial de Spring. Aviso oficial: https://spring.io/security/cve-2026-47883/ Título oficial: Spring Framework...

CVE-2026-47884

A flaw was found in the XsltView component of Spring MVC applications. This vulnerability could allow a remote, unauthenticated attacker to perform Server-Side Request Forgery SSRF, enabling them to make unauthorized requests from the server, and potentially achieve Remote Code Execution RCE,...

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

Linux Distros Unpatched Vulnerability : CVE-2026-47884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an / mapping that results in view rendering, and where the...

Linux Distros Unpatched Vulnerability : CVE-2026-47883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both...

Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management

Summary Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods developer portal and IBM webMethos API ControlPlane. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is using the...

Security Bulletin: Security Vulnerability in Spring MVC affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2024-38828)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring MVC Vulnerability Details CVEID:CVE-2024-38828 DESCRIPTION: Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack. CWE:CWE-400: Uncontroll...

DEBIAN-CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...