https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-27T15:02:11.330739+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-05825 bdu:2022-05825 2026-10-27T15:02:11.335154+00:00 bdu:2022-05825 https://cve.radiocsirt.org/vuln/cnvd-2015-06370 cnvd-2015-06370 2026-10-27T15:02:11.335187+00:00 cnvd-2015-06370 https://cve.radiocsirt.org/vuln/euvd-2026-93259 EUVD-2026-93259 2026-10-27T15:02:11.335202+00:00 EUVD-2026-93259 https://cve.radiocsirt.org/vuln/fkie_cve-2015-5169 fkie_cve-2015-5169 2026-10-27T15:02:11.335214+00:00

Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.

 https://cve.radiocsirt.org/vuln/ghsa-vwhv-j36g-5rm8 GHSA-vwhv-j36g-5rm8 — Cross-site Scripting in Apache Struts 2026-10-27T15:02:11.335240+00:00

Affected: Maven: org.apache.struts:struts2-core

When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script.

It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.

Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher.

 https://cve.radiocsirt.org/vuln/gsd-2015-5169 gsd-2015-5169 2026-10-27T15:02:11.335269+00:00 gsd-2015-5169 https://cve.radiocsirt.org/vuln/jvndb-2015-000125 jvndb-2015-000125 2026-10-27T15:02:11.335280+00:00

Apache Struts provided by the Apache Software Foundation is a software framework for creating Java web applications. Apache Struts contains a cross-site scripting vulnerability when devMode is left turned on. Masaki Yoshikawa of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.