CVE-2005-3745
Apache Struts Cross-site scripting Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
- Record
CVE-2005-3745- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
- Record
CVE-2005-3745- Updated
- 2026-11-02
EUVDEUVD-2022-3353 No score
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
- Record
EUVD-2022-3353- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9cjh-qmvx-436c No score
Apache Struts Cross-site scripting Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
- Record
GHSA-9cjh-qmvx-436c- Weakness
- CWE-80
- Updated
- 2026-11-02
OSVGHSA-9cjh-qmvx-436c No score
Apache Struts Cross-site scripting Vulnerability
Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
- Record
GHSA-9cjh-qmvx-436c- Weakness
- CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts-coreMaven |
through 1.2.7 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Struts 1.2.7 - Error Response Cross-Site Scripting | 2005-11-21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-3745 is a medium vulnerability (CVSS 4.3) in Apache Struts, published November 22, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 25.7%, the 97th percentile. No source names a fixed version.
References
redhat.com/support/errata/RHSA-2006-0161.html
vupen.com/english/advisories/2005/2525
osvdb.org/21021
securityfocus.com/bid/15512
hacktics.com/AdvStrutsNov05.html
Show 16 moreShow less
securitytracker.com/id?1015257
securityreason.com/securityalert/197
secunia.com/advisories/17677
lists.apache.org/thread.html/r02c2d634fa74209d941c90f9a4cd36a6f12366ca65f9b90446ff2de3%40%3Cissues.struts.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2005-3745
web.archive.org/web/20051230061138/http://www.hacktics.com/AdvStrutsNov05.html
github.com/advisories/GHSA-9cjh-qmvx-436c