CVE-2023-49735

CVE-2023-49735 affects Apache Tiles (2 onward). The DefaultLocaleResolver.LOCALE_KEY value, when used to resolve XML definition files, is not validated, enabling path traversal and potentially SSRF/XXE when user-controlled data is supplied. This vulnerability is tied to Tiles usage and is noted a...

CVE-2009-1275

Apache Tiles 2.1 before 2.1.2 (as used in Apache Struts and other products) is vulnerable because it evaluates EL expressions twice in certain circumstances, which can enable remote XSS or disclosure of sensitive information via the tiles:putAttribute and tiles:insertTemplate JSP tags. The CVE-20...