https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:33:18.630875+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-05999 bdu:2022-05999 2026-10-02T22:33:18.740890+00:00 bdu:2022-05999 https://cve.radiocsirt.org/vuln/certa-2013-avi-430 certa-2013-avi-430 — Une vulnérabilité a été corrigée dans <span class="textit">Apache Struts</span>. Elle permet à un attaquant de provoque… 2026-10-02T22:33:18.740932+00:00 certa-2013-avi-430 https://cve.radiocsirt.org/vuln/euvd-2026-256481 EUVD-2026-256481 2026-10-02T22:33:18.740952+00:00 EUVD-2026-256481 https://cve.radiocsirt.org/vuln/fkie_cve-2013-2251 fkie_cve-2013-2251 2026-10-02T22:33:18.740963+00:00

Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

 https://cve.radiocsirt.org/vuln/ghsa-47qp-8v9g-39hp GHSA-47qp-8v9g-39hp — Code injection in Apache Struts 2026-10-02T22:33:18.740992+00:00

Affected: Maven: org.apache.struts:struts2-core

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.

In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.

 https://cve.radiocsirt.org/vuln/gsd-2013-2251 gsd-2013-2251 2026-10-02T22:33:18.741020+00:00 gsd-2013-2251 https://cve.radiocsirt.org/vuln/jvndb-2013-003469 jvndb-2013-003469 2026-10-02T22:33:18.741032+00:00

Apache Struts contains a remote command execution vulnerability. Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a remote command execution vulnerability. This issue is the same issue that the developer published as S2-016 on July 16, 2013 Note that attacks leveraging this vulnerability have been confirmed. Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.