CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Adobe Experience Manager (AEM) Forms Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-54253, CISA KEV Active Exploitation)
[Affected Scope] Adobe Experience Manager (AEM) versions 6.5.23 and earlier (specifically with Forms module and Struts DevMode enabled)
[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands or code with system privileges
[Mitigation] Apply the official Adobe APSB25-82 security patch immediately and disable Struts DevMode in production environments
Zoho ManageEngine ServiceDesk Plus Unauthenticated Remote Code Execution Vulnerability (CVE-2021-44077) Analysis and Mitigation Guide
[Affected Scope] Zoho ManageEngine ServiceDesk Plus (before 11306), ServiceDesk Plus MSP (before 10530), and SupportCenter Plus (before 11014).
[Impact] Unauthenticated remote attackers can bypass authentication to upload and execute malicious files, gaining full system-level control over the target server.
[Mitigation] Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs).
Apache Struts 2 Double OGNL Evaluation Remote Code Execution Vulnerability (CVE-2020-17530, S2-061) Analysis and Mitigation Guide
[Affected Scope] Apache Struts framework versions 2.0.0 through 2.5.25
[Impact] Unauthenticated remote attackers can execute arbitrary code on the host system by exploiting forced double OGNL evaluation in tag attributes
[Mitigation] Immediately upgrade Apache Struts to version 2.5.26 or higher, and avoid evaluating raw user input inside Struts tag attributes
Apache Struts 2 Struts 1 Plugin Remote Code Execution Vulnerability (CVE-2017-9791, S2-048) Analysis and Mitigation Guide
[Affected Scope] Web applications running Apache Struts 2.1.x and 2.3.x that utilize the Struts 1 integration plugin (struts2-struts1-plugin)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands under the privileges of the web server, leading to complete system compromise
[Mitigation] Upgrade to the latest supported Apache Struts 2.5.x+ versions, or completely disable and remove the struts2-struts1-plugin dependency
Apache Struts 2 Jakarta Multipart Parser Remote Code Execution (RCE) Vulnerability (CVE-2017-5638) Analysis and Mitigation Guide
[Affected Scope] Web applications built on Apache Struts 2.3.x (before 2.3.32) and 2.5.x (before 2.5.10.1)
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with system privileges via crafted HTTP headers such as Content-Type
[Mitigation] Immediately upgrade Apache Struts to a secure version (2.3.32, 2.5.10.1, or higher) and apply WAF rules to block malicious OGNL payloads
Apache Struts 2 Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2013-2251, S2-016)
[Affected Scope] Apache Struts framework versions 2.0.0 through 2.3.15
[Impact] Remote attackers can execute arbitrary OGNL expressions via crafted 'action:', 'redirect:', or 'redirectAction:' parameter prefixes, leading to full system compromise
[Mitigation] Immediately upgrade Apache Struts to version 2.3.15.1 or higher, or implement strict WAF rules to block vulnerable parameter prefixes
Apache Struts 2 ExceptionDelegator OGNL Injection Remote Code Execution (CVE-2012-0391, S2-008)
[Affected Scope] Apache Struts versions prior to 2.2.3.1
[Impact] Unauthenticated remote attackers can execute arbitrary Java code with system privileges on the target server by sending crafted HTTP request parameters.
[Mitigation] Immediately upgrade Apache Struts to version 2.2.3.1 or later secure releases.