CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe Experience Manager (AEM) Forms Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-54253, CISA KEV Active Exploitation)
[Affected Scope] Adobe Experience Manager (AEM) versions 6.5.23 and earlier (specifically with Forms module and Struts DevMode enabled)
[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands or code with system privileges
[Mitigation] Apply the official Adobe APSB25-82 security patch immediately and disable Struts DevMode in production environments
Zoho ManageEngine ServiceDesk Plus Unauthenticated Remote Code Execution Vulnerability (CVE-2021-44077) Analysis and Mitigation Guide
[Affected Scope] Zoho ManageEngine ServiceDesk Plus (before 11306), ServiceDesk Plus MSP (before 10530), and SupportCenter Plus (before 11014).
[Impact] Unauthenticated remote attackers can bypass authentication to upload and execute malicious files, gaining full system-level control over the target server.
[Mitigation] Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs).
Apache Struts 2 Struts 1 Plugin Remote Code Execution Vulnerability (CVE-2017-9791, S2-048) Analysis and Mitigation Guide
[Affected Scope] Web applications running Apache Struts 2.1.x and 2.3.x that utilize the Struts 1 integration plugin (struts2-struts1-plugin)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands under the privileges of the web server, leading to complete system compromise
[Mitigation] Upgrade to the latest supported Apache Struts 2.5.x+ versions, or completely disable and remove the struts2-struts1-plugin dependency
Apache Struts 2 Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2013-2251, S2-016)
[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15
[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise
[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes
Apache Struts 2 ExceptionDelegator OGNL Injection Remote Code Execution (CVE-2012-0391, S2-008)
[Affected Scope] Apache Struts versions prior to 2.2.3.1
[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.
[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.
Apache Struts 1.x Remote Denial of Service Vulnerability Analysis and Mitigation (CVE-2006-1547)
[Affected Scope] Apache Struts versions prior to 1.2.9 deployed with Commons BeanUtils 1.7
[Impact] Remote attackers can trigger a Denial of Service (DoS) state by exhausting server resources via specially crafted multipart/form-data requests
[Mitigation] Upgrade Apache Struts to version 1.2.9 or higher, or implement input validation filters to block malicious parameter names