Years-Old Vulnerable Apache Struts 2 Versions See 387K Weekly Downloads

Over 387,000 users downloaded vulnerable Apache Struts versions this week. Exclusive Sonatype research reveals a high-risk flaw found by AI. Is your system at risk?...

The vulnerability of the Apache Struts software platform, related to the lack of authenticity checking for XML documents, allows attackers to execute XXE attacks.

The vulnerability of the Apache Struts software platform is related to the lack of authenticity checking for XML documents. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +272 more potentially affected by CVE-2025-68493 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.3.37)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =2.0.0, =1.2.4, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =2.2.1 and more Source cves: CVE-2025-68493 Source advisory: OSV:GHSA-QCFC-HMRC-59X7...

Apache Struts 2 is Missing XML Validation

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

GHSA-QCFC-HMRC-59X7 Apache Struts 2 is Missing XML Validation

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

CVE-2025-68493

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

CVE-2025-68493 Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

CVE-2025-68493

CVE-2025-68493 is a Missing XML Validation vulnerability in Apache Struts (XWork XML parser). Affected versions are Struts 2.0.0–2.2.1 and 2.2.1–6.1.0 (per the entry), with a recommended fix to upgrade to Struts 6.1.1. The issue enables an XML/XXE-type exposure due to lack of XML validation in th...

CVE-2025-68493: Improper Restriction of XML External Entity Reference

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

PT-2026-2157

CVE-2026-22162 - Apache Struts Command Injection CVE ID : CVE-2026-22162 Published : Jan. 7, 2026, 12:17 p.m. | 3 hours, 59 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Exploit for Deserialization of Untrusted Data in Apache Struts

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analizi Bu depo, Ap...

Exploit for Improper Handling of Exceptional Conditions in Apache Struts

SSP ASSIGNEMENT 3 : CVE poc Exploitation of CVE-2017-5638...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts

$ python3 ex...

PT-2026-1153

CVE-2025-22187 - Apache Struts Cross-Site Scripting XSS CVE ID : CVE-2025-22187 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity: 0.0 | NA Visi...

PT-2026-1161

CVE-2025-22195 - Apache Struts Command Injection Vulnerability CVE ID : CVE-2025-22195 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity: 0.0 | ...

PT-2026-1163

CVE-2025-22197 - Apache Struts Remote Code Execution Vulnerability CVE ID : CVE-2025-22197 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity: 0....

PT-2026-1157

CVE-2025-22191 - Apache Struts Cross-Site Scripting CVE ID : CVE-2025-22191 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity: 0.0 | NA Visit th...

PT-2026-1169

CVE-2025-22203 - Apache Struts Code Injection Vulnerability CVE ID : CVE-2025-22203 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity: 0.0 | NA...

PT-2026-1164

CVE-2025-22198 - Apache Struts Deserialization Remote Code Execution CVE ID : CVE-2025-22198 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity:...

PT-2026-1143

CVE-2025-22155 - Apache Struts Remote Code Execution Vulnerability CVE ID : CVE-2025-22155 Published : Jan. 1, 2026, 1:15 a.m. | 3 hours, 5 minutes ago Description : Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Severity: 0....