ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

cve-2024-38821

cve-2024-38821 Analysis: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

Spring-CVE

Spring CVE This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell". CVE-2022-22963 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing...

cve-2024-38819

CVE-2024-38819 01. File-Traversal and Webflux Overview 1 File-Traversal and WebFlux Overview File-Traversal Path Traversal vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22. Spring...

spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell Disclaimer: This repository is intended for educational and research purposes only. All exploit scripts must be used exclusively against systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-47883/ Official title: Spring Framework Open Redirect in...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-CU45491 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965 Spring4Shell: Vulnerability Analysis Name:...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375

Applications generated using JHipster (versions 7.0.0 through 9.4.0) are vulnerable to SQL Injection when using Spring WebFlux , Spring Data R2DBC , and a SQL database. The vulnerability exists because the sort request parameter from paginated entity-list endpoints is passed into the createOrderB...

CLEANSTART-2026-VX49826 PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1

Security vulnerability affects the apache-nifi-registry package. The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1...

CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

PT-2026-108109

Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...

CLEANSTART-2026-IY13000 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...