VulnerableCode Package Details - pkg:maven/org.springframework/spring-webmvc@3.0.2.RELEASE

Vulnerabilities affecting this package (23)

Advisory	Summary	Fixed in package version
GHSA-8cmm-qj8g-fcp6 Aliases: CVE-2014-0054	Cross-Site Request Forgery in Spring Framework The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 …	There are no reported fixed by versions.
GHSA-36p3-wjmg-h94x Aliases: CVE-2022-22965	Remote Code Execution in Spring Framework Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability …	5.2.20.RELEASE Vulnerable
CVE-2013-6430	Possible XSS The `JavaScriptUtils.javaScriptEscape` method in `web/util/JavaScriptUtils.java` in Spring MVC in Spring Framework does not properly escape certain characters, which …	3.2.2.RELEASE Vulnerable
CVE-2020-5421	Remote file disclosure In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser …	4.3.29.RELEASE Vulnerable 5.0.19.RELEASE Vulnerable 5.1.18.RELEASE Vulnerable 5.2.9.RELEASE Vulnerable
CVE-2014-1904	Cross-site scripting flaw Cross-site scripting (XSS) vulnerability in `web/servlet/tags/form/FormTag.java` in Spring MVC in this package allows remote attackers to inject …	3.2.8.RELEASE Vulnerable 4.0.2.RELEASE Vulnerable
GHSA-2m8h-fgr8-2q9w Aliases: CVE-2016-9878	Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized An issue was discovered in Pivotal Spring Framework …	There are no reported fixed by versions.
GHSA-f93f-g33r-8pcp Aliases: CVE-2014-0225	Improper Restriction of XML External Entity Reference in Spring Framework When processing user provided XML documents, the Spring Framework 4.0.0 …	There are no reported fixed by versions.
CVE-2016-9878	Path Traversal Paths provided to the `ResourceServlet` were not properly sanitized and as a result exposed to directory traversal attacks.	3.2.18.RELEASE Vulnerable 4.3.5.RELEASE Vulnerable 3.2.18.RELEASE Vulnerable 4.3.5.RELEASE Vulnerable
CVE-2018-1272	Improper Privilege Management When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and …	5.0.5.RELEASE Vulnerable 5.0.5.RELEASE Vulnerable
CVE-2018-1271	Path Traversal Spring Framework allows applications to configure Spring MVC to serve static resources (e.g., CSS, JS, images). When static …	4.3.15.RELEASE Vulnerable 5.0.5.RELEASE Vulnerable 4.3.15.RELEASE Vulnerable 5.0.5.RELEASE Vulnerable
GHSA-ff7p-jqjm-v66h Aliases: CVE-2014-1904	Improper Neutralization of Input During Web Page Generation in Spring Framework Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC …	3.2.8.RELEASE Vulnerable 4.0.2.RELEASE Vulnerable 3.2.8.RELEASE Vulnerable
GHSA-g5vr-rgqm-vf78 Aliases: CVE-2024-38819	Spring Framework Path Traversal vulnerability Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to …	There are no reported fixed by versions.
GHSA-wg35-8jpf-2xv3 Aliases: CVE-2026-22741	Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be …	7.0.7 Vulnerable 6.2.18 Vulnerable 7.0.7 Vulnerable 6.2.18 Vulnerable
GHSA-6p4f-wcwh-5vvm Aliases: CVE-2026-22745	Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application …	7.0.7 Vulnerable 6.2.18 Vulnerable
GHSA-957g-f97v-vppc Aliases: CVE-2026-41846	Spring Framework Cross-site Scripting via JSP Form Tags Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-h3qp-gqrc-q736 Aliases: CVE-2026-41844	Spring Framework Open Redirect in Spring MVC and WebFlux A Spring MVC or Spring WebFlux application which configures a mapping …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-mq64-j8f9-9gcj Aliases: CVE-2026-41841	Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-72pg-x5f8-j25j Aliases: CVE-2026-41843	Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-x23c-287f-qqv5 Aliases: CVE-2026-41842	Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-cjpg-rgq5-fr37 Aliases: CVE-2026-41853	Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux Spring MVC and WebFlux applications are vulnerable to Multipart request …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-3chg-m5w7-qfv5 Aliases: CVE-2026-41845	Spring Framework Cross-site Scripting via JavaScriptUtils Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection …	7.0.8 Vulnerable 6.2.19 Vulnerable
GHSA-pc63-qcmh-9cmg Aliases: CVE-2026-47884	Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and …	There are no reported fixed by versions.
CVE-2026-47884 Aliases: GHSA-pc63-qcmh-9cmg	Spring Framework Improper Path Limitation in XsltView Use of XsltView in a Spring MVC application can result in SSRF and …	7.0.9 Not vulnerable

Next non-vulnerable version	7.0.9
Latest non-vulnerable version	7.0.9
Risk score	10.0