Struts

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:struts:2.1:*:*:*:*:*:*:*

part: a version: 2.1 update: *

VendorApache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95)
ProductStruts (81290744-d0e7-54d4-b3f9-3824c68dbf99)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:apache/struts purl2cpe 2026-06-01 10:14:32.162771
pkg:github/apache/struts purl2cpe 2026-06-01 10:14:32.162773
pkg:maven/org.apache.struts/struts purl2cpe 2026-06-01 10:14:32.162774
pkg:maven/org.apache.struts/struts-core purl2cpe 2026-06-01 10:14:32.162776
pkg:rpm/opensuse/struts purl2cpe 2026-06-01 10:14:32.162777

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2016-2162 vulnerable 2026-06-08 05:07:33.444922 Details available
Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
Published: 2016-04-12T16:00:00.000Z
Updated: 2024-08-05T23:17:50.768Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2008-6682 vulnerable 2026-06-08 04:51:04.570220 Details available
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via vectors associated with improper handling of (1) " (double quote) characters in the href attribute of an s:a tag and (2) parameters in the action attribute of an s:url tag.
Published: 2009-04-09T15:00:00.000Z
Updated: 2024-08-07T11:41:59.972Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.