PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell Disclaimer: This repository is intended for educational and research purposes only. All exploit scripts must be used exclusively against systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-47883/ Official title: Spring Framework Open Redirect in...

cve-2023-34035-mitigations

This repo is a set of samples to demonstrate the arrangements wherein applications may be vulnerable to https://spring.io/security/cve-2023-34035CVE-2023-34035. An application is vulnerable when all of the following are true: Spring MVC is on the classpath DispatcherServlet and at least one other...

Spring MVC Framework - Local File Inclusion

Spring MVC Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported are vulnerable to local file inclusion because they allow applications to configure Spring MVC to serve static resources e.g. CSS, JS, images. A malicious user can send a request using a...

CVE-2022-22965

Spring4Shell Vulnerability - CVE-2022-22965 📕 Introduction The spring4shell vulnerability was named this way due to 2 vulnerabilities found and widely exploited by attackers in early 2022. One of these vulnerabilities is in the framework component called "Spring Cloud Functions" less critical and...

spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965 Spring4Shell: Vulnerability Analysis Name:...

Atlassian Confluence 7.16.x < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104502)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104502 advisory. - Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring...

Security Bulletin: Multiple vulnerabilties in DevOps Test Hub

Summary Multiple vulnerabilities addressed in DevOps Test Hub in version 11.0.9 Vulnerability Details CVEID:CVE-2026-22735 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE. This issue affects Spring Foundation: from 7.0.0 throu...

Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in the third party libraries shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-59313 DESCRIPTION: Spring MVC applications using the functional web framework are vulnerable to stream corruption...

CLEANSTART-2026-IL27901 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the apache-nifi-registry package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-SB20243 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the apache-nifi-registry package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-ZG60550 Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE)

Security vulnerability affects the rundeck package. Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE...

CLEANSTART-2026-SC51338 Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors...

CLEANSTART-2026-WP23886 Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments

Security vulnerability affects the rundeck package. Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events SSE with view fragments...

CLEANSTART-2026-XW09106 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect

Security vulnerability affects the rundeck package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...

CLEANSTART-2026-GO94409 Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly speci...

Security vulnerability affects the rundeck package. Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified...

Security Bulletin: As an Spring MVC application, IBM Sterling Control Center is vulnerable to Path Traversal, Open Redirect and CRLF Injection (CVE-2026-47884, CVE-2026-47887, CVE-2026-47890)

Summary Spring MVC framework is used by IBM Sterling Control Center and as part of dependency one of them is in spring-webmvc-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an...

Spring Framework 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 SSE Stream Corruption

The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.50, 6.0.x prior to 6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a vulnerability: - Spring MVC applications using the functional web framework are...

Security Bulletin: Vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE. Vulnerabilities include Netty can cause native memory exhaustion, An attacker can bypass the short-circuit mechanism by sending a reques...