PoC-CVE-2022-22965-Spring4Shell

PoC — CVE-2022-22965 Spring4Shell Disclaimer: This repository is intended for educational and research purposes only. All exploit scripts must be used exclusively against systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by...

cve-2024-38819-lab

CVE-2024-38819 Customer Vault Lab This is a Cloud Foundry-ready Spring Boot demo for CVE-2024-38819, a Spring Framework path traversal vulnerability in functional static resource handling. What Is Patched? CVE-2024-38819 is patched in Spring Framework , not directly in Spring Boot. Spring Boot is...

cve-2024-38821

cve-2024-38821 Analysis: https://www.deep-kondah.com/spring-webflux-static-resource-access-vulnerability-cve-2024-38821-explained/...

Spring-CVE

Spring CVE This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell". CVE-2022-22963 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing...

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

cve-2024-38819

CVE-2024-38819 01. File-Traversal and Webflux Overview 1 File-Traversal and WebFlux Overview File-Traversal Path Traversal vulnerability allows an attacker to bypass file system permissions in a web application and access arbitrary files, and is a type of attack designated as CWE-22. Spring...

spring-RCE-CVE-2022-22965

Vulnerability Overview Recently, Spring released a major CVE vulnerability. The CVE information states: "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as ...

ROOT-APP-MAVEN-CVE-2026-47892 CVE-2026-47892 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-47892 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-WK76356 WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request

Security vulnerability affects the rundeck package. A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CLEANSTART-2026-CU45491 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the rundeck package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

Exploit for Code Injection in Vmware Spring_Framework

CVE-2022-22965 Spring4Shell: Vulnerability Analysis Name:...

VulnCheck KEV: CVE-2025-41243

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: The application is using Spring Cloud Gateway Server Webflux Spring Cloud Gateway Server WebMVC is not vulnerable...

CVE-2026-47883

CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-47883/ Official title: Spring Framework Open Redirect in...

CVE-2026-107375

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

NPM: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

NPM: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applicationssort vulnerability discovered by ? in WordPress Npm generator-jhipster versions = 7.0.0, 9.4.0...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...