org.apache.struts.xwork:xwork-core vulnerabilities (Maven)

16 vulnerabilities.

• org.apache.struts.xwork:xwork-core Maven Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component CVE-2025-68493 Public exploitFix available EPSS 50.4% 8.1 HighJanuary 11, 2026
• org.apache.struts.xwork:xwork-core Maven Apache Struts Open Redirect CVE-2016-4433 Fix available 7.5 HighJuly 4, 2016
• org.apache.struts.xwork:xwork-core Maven Apache Struts CSRF Vulnerability CVE-2016-4430 Fix available 8.8 HighJuly 4, 2016
• org.apache.struts.xwork:xwork-core Maven Incomplete exclude pattern in Apache Struts CVE-2015-1831 Fix available 7.5 HighJuly 16, 2015
• org.apache.struts.xwork:xwork-core Maven ClassLoader manipulation in Apache Struts CVE-2014-0094 Public exploitFix available EPSS 99.4% 5.0 MediumMarch 10, 2014
• org.apache.struts.xwork:xwork-core Maven Arbitrary code execution in Apache Struts 2 CVE-2013-2135 Fix available EPSS 13.8% 9.3 HighJuly 16, 2013
• org.apache.struts.xwork:xwork-core Maven Arbitrary code execution in Apache Struts 2 CVE-2013-2134 Public exploitFix available EPSS 70.2% 9.3 HighJuly 16, 2013
• org.apache.struts.xwork:xwork-core Maven Code injection in Apache Struts CVE-2013-2115 Public exploitFix available EPSS 74.6% 8.1 HighJuly 10, 2013
• org.apache.struts.xwork:xwork-core Maven Arbitrary code execution in Apache Struts CVE-2013-1966 Public exploitFix available EPSS 73.7% 9.3 HighJuly 10, 2013
• org.apache.struts.xwork:xwork-core Maven Denial of service in Apache Struts CVE-2012-4387 Fix available 5.0 MediumSeptember 5, 2012
• org.apache.struts.xwork:xwork-core Maven Apache Struts Code injection due to conversion error CVE-2012-0838 Fix available EPSS 13.7% 10.0 HighMarch 2, 2012
• org.apache.struts.xwork:xwork-core Maven Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode CVE-2012-0394 Public exploitFix availableDisputed EPSS 72.9% 6.8 MediumJanuary 8, 2012
• org.apache.struts.xwork:xwork-core Maven Apache Struts's ParameterInterceptor component does not prevent access to public constructors CVE-2012-0393 Public exploitFix available EPSS 36.3% 6.4 MediumJanuary 8, 2012
• org.apache.struts.xwork:xwork-core Maven Apache Struts's CookieInterceptor component does not use the parameter-name whitelist CVE-2012-0392 Public exploitFix available EPSS 97.5% 6.8 MediumJanuary 8, 2012
• org.apache.struts.xwork:xwork-core Maven Apache Struts Remote Java Code Execution CVE-2012-0391 In KEVPublic exploitFix available EPSS 75.6% 9.8 CriticalJanuary 8, 2012
• org.apache.struts.xwork:xwork-core Maven XWork in Apache Struts Reveals Sensitive Information CVE-2011-2088 Fix available 5.0 MediumMay 13, 2011