CVE-2025-68493

CVE-2025-68493 CVE-2025-68493 7. References 1 Apache Struts XWork XML Vulnerability CVE-2025-68493 PoC and Script | ZONE.CI Global Network. https://zone.ci/secarticles/wx/486533.html 8. Vulnerability Verification and Exploitation To verify and exploit the CVE-2025-68493 vulnerability, you can use...

CVE-2023-22515-POC

CVE-2023-22515 CVE-2023-22515, a critical vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center, a Broken Access Control vulnerability. Attlassian has provided a CVSS base score of 10.0 Exploit Brief explanation: 1- Due to how Xwork interceptors parses...

CVE-2021-26084

CVE-2021-26084 Affected Versions Versions 6.13.23 6.14.0 ≤ Version 7.4.11 7.5.0 ≤ Version 7.11.6 7.12.0 ≤ Version 7.12.5 Cause and Exploitation Method Confluence uses a framework to map URLs to Java classes, creating what is known as an "action". Action URLs end with ".action" and are defined in...

CVE-2025-68493 impact on Bamboo

h3. Issue Summary Impact of CVE-2025-68493 in Bamboo https://cwiki.apache.org/confluence/display/WW/S2-069 Parsing of XML configuration in XWork component does not validate XML in proper way and it's vulnerable to XML external entity XXE injection. h3. Steps to Reproduce ||Impact of...

Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.1.1 XML External Entity Injection in XWork (S2-069)

The version of Apache Struts installed on the remote host is 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, or 6.x prior to 6.1.1. It is, therefore, affected by an XML external entity injection XXE vulnerability in the XWork component: - Missing XML Validation vulnerability in Apache Struts, Apache...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +272 more potentially affected by CVE-2025-68493 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.3.37)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =2.0.0, =1.2.4, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =2.2.1 and more Source cves: CVE-2025-68493 Source advisory: GHSA-QCFC-HMRC-59X7...

br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8), br.net.woodstock.rockframework:rockframework-web (>=1.2.4, <=3.0.1) +272 more potentially affected by CVE-2025-68493 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.3.37)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =2.0.0, =1.2.4, =1.5.3, =1.5.3, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =1.0, =1.0, =1.0, =1.0, =2.0.0, =2.2.1 and more Source cves: CVE-2025-68493 Source advisory: OSV:GHSA-QCFC-HMRC-59X7...

be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +58 more potentially affected by CVE-2025-68493 via com.opensymphony:xwork (>=2.0.4, <=2.1.3)

com.opensymphony:xwork MAVEN version =2.0.4, =1.2.1, =4.0.1, =0.9.2, =1.1.5, =1.3.3, =1.3.1, =2.0.5-incubating, =2.0.9, =2.0.11, =2.0.9, =2.0.9, =2.0.9, =2.1.6 - org.apache.struts:struts2-convention-plugin 2.1.6 and more Source cves: CVE-2025-68493 Source advisory: OSV:GHSA-QCFC-HMRC-59X7...

CVE-2025-68493 Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

CVE-2025-68493 Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue...

CVE-2025-68493

CVE-2025-68493 is a Missing XML Validation vulnerability in Apache Struts (XWork XML parser). Affected versions are Struts 2.0.0–2.2.1 and 2.2.1–6.1.0 (per the entry), with a recommended fix to upgrade to Struts 6.1.1. The issue enables an XML/XXE-type exposure due to lack of XML validation in th...

PT-2026-1915

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 6.1.0 Description An XML processing flaw exists in the XWork component of Apache Struts, specifically within the unconfigured SAX parser of the DomHelper class. The component fails to properly validate XML...

EUVD-2022-4099

Malicious code in bioql PyPI...

SUSE CVE-2011-2088

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772....

Apache Struts OGNL Injection

The vulnerability of the OGNL expression transformation class implementation in the XWork expression structure of the Apache Struts software framework is related to deficiencies in access control when using the ParametersInterceptor class with the parameter. Exploiting this vulnerability allows a...

Cross-site Scripting in Apache Struts

Multiple Cross-Site Scripting XSS in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation DMI is enabled, the action name is generated dynamically...

GHSA-56F8-G68R-J699 Cross-site Scripting in Apache Struts

Multiple Cross-Site Scripting XSS in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation DMI is enabled, the action name is generated dynamically...

com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (2.4.0), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (2.4.0) +71 more potentially affected by CVE-2016-4433 via org.apache.struts.xwork:xwork-core (>=2.3.20, <=2.3.28.1)

org.apache.struts.xwork:xwork-core MAVEN version =2.3.20, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =2.0.1, =2.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.7 - com.weicoder:frame 1.1.0 and more Source cves: CVE-2016-4433 Source advisory: OSV:GHSA-WM8W-QP2F-728Q...

com.amashchenko.struts2.actionflow:struts2-actionflow-plugin (2.4.0), com.amashchenko.struts2.actionflow:struts2-actionflow-showcase (2.4.0) +71 more potentially affected by CVE-2016-4433 via org.apache.struts.xwork:xwork-core (>=2.3.20, <=2.3.28.1)

org.apache.struts.xwork:xwork-core MAVEN version =2.3.20, =1.2.2, =1.2.2, =1.2.2, =1.2.2, =2.0.1, =2.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.7 - com.weicoder:frame 1.1.0 and more Source cves: CVE-2016-4433 Source advisory: GHSA-WM8W-QP2F-728Q...

br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2), info.kfgodel:bean2bean (>=1.1.5, <=1.1.6) +27 more potentially affected by CVE-2008-6504 via com.opensymphony:xwork (>=2.1.0, <=2.1.1)

com.opensymphony:xwork MAVEN version =2.1.0, =1.2.1, =1.1.5, =1.1.6 - net.sf.fastupload:fastupload-core 0.4.7 - org.apache.struts:struts2-apps 2.1.2 - org.apache.struts:struts2-blank 2.1.2 - org.apache.struts:struts2-codebehind-plugin 2.1.2 - org.apache.struts:struts2-config-browser-plugin 2.1.2 ...