Lucene search
+L

267 matches found

Nuclei
Nuclei
added 2026/09/19 2:05 a.m.116 views

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

5.9CVSS7.2AI score0.34444EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/18 11:28 p.m.13 views

spring-RCE-CVE-2022-22965

脆弱性の概要 最近、Spring で重大な CVE 脆弱性が報じられました。CVE 情報には"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spri...

9.8CVSS7.7AI score0.99638EPSS
SaveExploits105
Kitploit
Kitploit
added 2026/09/18 2:02 p.m.12 views

cve-2023-34035-mitigations

このリポジトリは、アプリケーションが https://spring.io/security/cve-2023-34035CVE-2023-34035 に対して脆弱になりうる構成を示すサンプルセットです。 アプリケーションは、以下のすべてが当てはまる場合に脆弱です。 Spring MVC がクラスパス上にある DispatcherServlet と少なくとも 1 つの他のサーブレットがマッピングされている。そのうちの 1 つにパスベースのサーブレットマッピング(例: /path/)がある。 アプリケーションが、サーブレットマッピングが /path/ 形式のエンドポイントを参照するために...

7.3CVSS6.8AI score0.00658EPSS
SaveExploits1References1
Kitploit
Kitploit
added 2026/09/16 10:52 a.m.8 views

CVE-2022-22965

Spring4Shellの脆弱性 - CVE-2022-22965 📕 はじめに spring4shellの脆弱性は、2022年初頭に攻撃者によって発見され広く悪用された2つの脆弱性にちなんでこのように命名されました。これらの脆弱性の1つは「Spring Cloud Functions」と呼ばれるフレームワークコンポーネント(重要度は低い)に存在し、2つ目でより重要度が高いコンポーネントは、フレームワークの中心である「Spring...

9.8CVSS8.2AI score0.99638EPSS
SaveExploits105
Kitploit
Kitploit
added 2026/09/15 5:10 p.m.8 views

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell 免責事項: このリポジトリは 教育および研究目的のみ を意図しています。 すべてのエクスプロイトスクリプトは、自分が所有するシステム、または明示的な書面による 許可を得たシステムに対してのみ使用する必要があります。著者は、この資料の誤用または損害について一切責任を負いません。 CVE-2022-22965は、2022年4月に公開されたSpring Frameworkにおける重大なリモートコード実行(RCE)脆弱性であり、その調査と概念実証(PoC)です。 脆弱性の概要 Spring4Shell...

9.8CVSS8.1AI score0.99638EPSS
SaveExploits105References1
Kitploit
Kitploit
added 2026/09/14 4:40 a.m.9 views

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC このリポジトリは、Spring公式セキュリティアドバイザリとして公開された CVE-2026-47883 の最小再現PoCです。 公式アドバイザリ: https://spring.io/security/cve-2026-47883/ 公式タイトル: Spring Framework Open Redirect in UrlHandlerFilter 深刻度: Medium CVSS v3.1: 5.4...

6.1CVSS5.9AI score0.00187EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/09/08 12:16 p.m.8 views

CVE-2026-47884

A flaw was found in the XsltView component of Spring MVC applications. This vulnerability could allow a remote, unauthenticated attacker to perform Server-Side Request Forgery SSRF, enabling them to make unauthorized requests from the server, and potentially achieve Remote Code Execution RCE,...

9.8CVSS6.8AI score0.00422EPSS
SaveExploits0References4
Veracode
Veracode
added 2026/09/08 8:50 a.m.9 views

Denial Of Service (DoS)

Spring Framework is vulnerable to Denial Of Service. The vulnerability is due to stream corruption when Server-Sent Events SSE are used with functional web framework applications in Spring MVC...

9.8CVSS6.1AI score0.00387EPSS
SaveExploits0References1Affected Software1
Tenable Nessus
Tenable Nessus
added 2026/08/31 12:00 a.m.13 views

Linux Distros Unpatched Vulnerability : CVE-2026-47884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an / mapping that results in view rendering, and where the...

9.8CVSS6.2AI score0.00422EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/08/31 12:00 a.m.9 views

Linux Distros Unpatched Vulnerability : CVE-2026-47883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both...

6.1CVSS5.9AI score0.00187EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/28 4:56 a.m.34 views

Security Bulletin: Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods API Management

Summary Multiple vulnerabilities in Spring Boot's Cassandra have been addressed in IBM webMethods developer portal and IBM webMethos API ControlPlane. Vulnerability Details CVEID:CVE-2026-22746 DESCRIPTION: Vulnerability in Spring Spring Security. If an application is using the...

7.5CVSS6.7AI score0.00363EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/27 10:00 p.m.9 views

Security Bulletin: Security Vulnerability in Spring MVC affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2024-38828)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Spring MVC Vulnerability Details CVEID:CVE-2024-38828 DESCRIPTION: Spring MVC controller methods with an @RequestBody byte method parameter are vulnerable to a DoS attack. CWE:CWE-400: Uncontroll...

5.3CVSS5.9AI score0.00724EPSS
SaveExploits0Affected Software1
OSV
OSV
added 2026/08/27 8:17 p.m.12 views

DEBIAN-CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

6.1CVSS5.9AI score0.00181EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/08/27 8:17 p.m.12 views

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

9.8CVSS5.9AI score0.00387EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/08/27 8:17 p.m.11 views

CVE-2026-59281

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

6.1CVSS5.9AI score0.00181EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/08/27 5:58 p.m.24 views

CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

5.9AI score0.00387EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 5:58 p.m.14 views

EUVD-2026-67193

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

5.5AI score0.00387EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/27 5:57 p.m.140 views

CVE-2026-59281

Spring Framework versions 5.2.25.RELEASE and earlier through 7.0.8 are affected by a reflected cross-site scripting (XSS) vulnerability in Spring MVC and WebFlux. The root cause is that the no-argument Errors.getFieldErrors() and Errors.getFieldError() accessors return unescaped field error conte...

6.1CVSS5.2AI score0.00181EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/27 5:57 p.m.44 views

CVE-2026-59281 Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

0.00181EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/27 5:57 p.m.12 views

EUVD-2026-67170

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

5.2AI score0.00181EPSS
SaveExploits0References1
Rows per page
Query Builder