https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T13:50:19.113940+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-115021 EUVD-2026-115021 2026-10-03T13:50:19.117105+00:00 EUVD-2026-115021 https://cve.radiocsirt.org/vuln/fkie_cve-2011-1772 fkie_cve-2011-1772 2026-10-03T13:50:19.117137+00:00

Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.

 https://cve.radiocsirt.org/vuln/ghsa-56f8-g68r-j699 GHSA-56f8-g68r-j699 — Cross-site Scripting in Apache Struts 2026-10-03T13:50:19.117168+00:00

Affected: Maven: org.apache.struts:struts2-core

Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.

 https://cve.radiocsirt.org/vuln/gsd-2011-1772 gsd-2011-1772 2026-10-03T13:50:19.117195+00:00 gsd-2011-1772 https://cve.radiocsirt.org/vuln/jvndb-2011-000106 jvndb-2011-000106 2026-10-03T13:50:19.117207+00:00

Apache Struts may create web applications that contain a cross-site scripting vulnerability. Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts may create web applications that contain a cross-site scripting vulnerability. Toshiharu Sugiyama from UBSecure, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.