CVE-2025-8525

A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-8525 Exrick xboot Spring Boot Admin/Spring Actuator information disclosure

A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-8525 Exrick xboot Spring Boot Admin/Spring Actuator information disclosure

A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-8525

CVE-2025-8525 affects Exrick xboot up to 3.3.4, with a root cause tied to an information disclosure in the area of Spring Boot Admin/Spring Actuator . The vulnerability can be triggered remotely and the exploit has been publicly disclosed. Multiple connected sources corroborate the same impact an...

CVE-2025-8525: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/Spring Actuator. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been...

PT-2025-31864 · Exrick +1 · Exrick Xboot +2

Name of the Vulnerable Software and Affected Versions: Exrick xboot versions up to 3.3.4 Description: A vulnerability exists in Exrick xboot that may lead to information disclosure. The issue affects an unknown part of the component Spring Boot Admin/Spring Actuator and can be initiated remotely...

This Week in Spring - July 29th, 2025

It's the end of July! JULY! The seventh month of the year, done and dusted! AHHHHH! I've got memories of being on a tropical beach over the winter holidays, sipping rum and dodging mosquitoes like I was doing a rhythmic gymnastics routine just recently. It turns out that was seven months ago, not...

java-sec-code

This is an offensive tool for Java web applications. It is a collection of Java web common vulnerabilities and security code, based on Spring Boot and Spring Security. The repository contains various types of vulnerabilities, including actuators to RCE, command inject, CORS, CRLF injection, CSRF,...

This Week in Spring - July 22nd, 2025

Hi, Spring fans! It's almost SpringOne time!! AAAAH it's all moving so quickly! I can hardly stand it. SpringOne's next month, in lovely Las Vegas, and I'll be there. Will you? Have you registered? We'll be looking at the impending Spring Boot 4.0 and Spring Framework 7.0 releases! It's going to ...

cn.centychen:xxl-job-spring-boot-starter (>=1.0.0-release, <=1.0.1-release), cn.db101:xxl-job-spring-boot-starter (1.1.0) potentially affected by CVE-2025-7787 via com.xuxueli:xxl-job-core (2.0.2)

com.xuxueli:xxl-job-core MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - cn.centychen:xxl-job-spring-boot-starter =1.0.0-release, =1.0.1-release - cn.db101:xxl-job-spring-boot-starter...

com.budwk.nb:budwk-nutzboot-starter-xxl-job (6.1.0), com.github.kancyframework:delay-message-scheduler (0.0.1-release) +2 more potentially affected by CVE-2025-7787 via com.xuxueli:xxl-job-core (2.1.2)

com.xuxueli:xxl-job-core MAVEN version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - com.budwk.nb:budwk-nutzboot-starter-xxl-job 6.1.0 - com.github.kancyframework:delay-message-scheduler...

com.battcn.boot:extend-xxl-job-spring-boot-starter (>=2.1.1-release, <=2.1.2-release), com.lingdonge:cloud-xxl-job (3.0.5) +1 more potentially affected by CVE-2025-7787 via com.xuxueli:xxl-job-core (2.1.0)

com.xuxueli:xxl-job-core MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - com.battcn.boot:extend-xxl-job-spring-boot-starter =2.1.1-release, =3.0.0, =3.0.1 Source cves: CVE-2025-7787...

cn.smilevers:xxljob-spring-boot-starter (1.8.2-release) potentially affected by CVE-2025-7787 via com.xuxueli:xxl-job-core (1.8.2)

com.xuxueli:xxl-job-core MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - cn.smilevers:xxljob-spring-boot-starter 1.8.2-release Source cves: CVE-2025-7787 Source advisory:...

com.roncoo:roncoo-spring-boot-starter-xxl-job (>=1.0.7, <=1.0.8), com.wueasy:wueasy-task-xxl-job (3.1.0) potentially affected by CVE-2025-7787 via com.xuxueli:xxl-job-core (2.1.1)

com.xuxueli:xxl-job-core MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - com.roncoo:roncoo-spring-boot-starter-xxl-job =1.0.7, =1.0.8 - com.wueasy:wueasy-task-xxl-job 3.1.0 Source cves...

Cisco Identity Services Engine IpAccessFilter Direct Request Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass IP restrictions on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of the web.xml file. The issue results from an incomplete...

This Week in Spring - July 15th, 2025

Hi, Spring fans! It's already the 15th of July! We're closer to 2026 than we are to 2024. And time's sure flying. Like I will, tomorrow. I'll be flying to Denver for the amazing UBERCONF software show! I'll be doing a workshop and two talks, and if you're there, I hope you'll come say "hi"! Let's...

SpringBoot_MyBatisPlus Path Traversal Vulnerability

SpringBootMyBatisPlus is a SpringBoot integration with MyBatisPlus by Siwei Zhou, an individual developer. A path traversal vulnerability exists in SpringBootMyBatisPlus, which stems from path traversal due to incorrect manipulation of the parameter Name in file/file/download...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=2.1.8, <=2.2.1), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=2.1.8, <=2.2.1) +131 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (8.20.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =2.1.8, =2.1.8, =2.1.8, =3.4.0, =3.3.0,...

com.atlassian.connect:atlassian-connect-spring-boot-core (>=0.9.0-alpha, <=1.3.6), com.atlassian.connect:atlassian-connect-spring-boot-jwt (>=0.9.0-alpha, <=1.3.6) +3 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (3.6)

com.nimbusds:nimbus-jose-jwt MAVEN version 3.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.atlassian.connect:atlassian-connect-spring-boot-core =0.9.0-alpha, =0.9.0-alpha, =0.9.0-alpha,...

Sensitive Information Exposure

io.zipkin, zipkin-server is vulnerable to Sensitive Information Exposure. The vulnerability is due to the presence of an unprotected /heapdump endpoint associated with Spring Boot Actuator, which allows an attacker to retrieve memory dumps and potentially extract sensitive data. Note: There is a...