be.objectify:objectify-struts2-tags (1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1, <=1.2.2) +58 more potentially affected by CVE-2025-68493 via com.opensymphony:xwork (>=2.0.4, <=2.1.3)

🗓️ 11 Jan 2026 15:31:59Reported by Vulners OSVType

vulnersosv🔗 osv.dev👁 2 Views

XWork <=2.1.3 RCE vulnerability affects Struts2 apps via Maven transitive dependencies.

Reporter	Title	Published	Views	Family All 26
IBM Security Bulletins	Security Bulletin: Remediation of Multiple Apache Struts Vulnerabilities in IBM Library Support for Struts	9 Mar 202610:35	–	ibm
Atlassian	CVE-2025-68493 impact on Bamboo	13 Feb 202611:45	–	atlassian
Atlassian	Missing XML Validation vulnerability in Apache Struts Dependency in Bamboo Data Center	11 Mar 202613:10	–	atlassian
Tenable Nessus	Atlassian Bamboo 9.6.x < 9.6.24 / 10.x < 10.2.16 / 11.x / 12.x < 12.1.3 Multiple Vulnerabilities	25 Mar 202600:00	–	nessus
Tenable Nessus	Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.1.1 XML External Entity Injection in XWork (S2-069)	16 Jan 202600:00	–	nessus
BDU FSTEC	The vulnerability of the Apache Struts software platform, related to the lack of authenticity checking for XML documents, allows attackers to execute XXE attacks.	14 Jan 202600:00	–	bdu_fstec
GithubExploit	Exploit for Missing XML Validation in Apache Struts	4 Feb 202601:57	–	githubexploit
Circl	CVE-2025-68493	11 Jan 202615:34	–	circl
CNNVD	Apache Struts 安全漏洞	11 Jan 202600:00	–	cnnvd
CVE	CVE-2025-68493	11 Jan 202613:05	–	cve

03 Feb 2026 03:17Current

8.1High risk

Vulners AI Score8.1

CVSS 3.18.1

EPSS0.37055

SSVC

xwork struts2 rce maven dependency-chain cve-2025-68493 java