Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.springframework/spring-webmvc@3.0.0
purl pkg:maven/org.springframework/spring-webmvc@3.0.0
Next non-vulnerable version 3.2.8
Latest non-vulnerable version 7.0.7
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-a796-tmtn-6bac
Aliases:
CVE-2014-0225
GHSA-f93f-g33r-8pcp
Information disclosure via SSRF This package did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
3.2.8
Affected by 0 other vulnerabilities.
4.0.5
Affected by 0 other vulnerabilities.
VCID-vw31-4w5h-rucb
Aliases:
CVE-2013-6430
GHSA-xjrf-8x4f-43h4
Improper Neutralization of Input During Web Page Generation in Spring Framework The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
3.2.2.RELEASE
Affected by 8 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-04T16:19:43.871789+00:00 GitLab Importer Affected by VCID-vw31-4w5h-rucb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-webmvc/CVE-2013-6430.yml 38.6.0
2026-06-02T04:42:55.010311+00:00 GitLab Importer Affected by VCID-a796-tmtn-6bac https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-webmvc/CVE-2014-0225.yml 38.6.0