> CVE-2025-68493

« BACK_TO_HOME
PUBLISHED
2026-01-11 13:15
MODIFIED
2026-01-11 13:15
EPSS (Prob. Exploit)
50.42%
Top 1.1%
⚡ EPSS ÉLEVÉ (50.4%)
🎯 NUCLEI TEMPLATE
DATA SOURCES:
NVD 🔗 2026-01-11 RED HAT 🔗 2026-01-18 CVE PROJECT 🔗 2026-01-19 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08 NUCLEI 🔗 2026-11-08

> DESCRIPTION

Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-112

> CWE DETAILED DESCRIPTIONS

CWE-112: Missing XML Validation - The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-qcfc-hmrc-59x7 HIGH

Apache Struts 2 is Missing XML Validation

AFFECTED PACKAGES:
MAVEN / org.apache.struts.xwork:xwork-core
>= 2.2.1, < 6.1.1
MAVEN / com.opensymphony:xwork
>= 2.0.0, < 2.2.1
MAVEN / org.apache.struts:struts2-core
>= 6.0.0, < 6.1.1
Fixed in: 6.1.1
MAVEN / org.apache.struts:struts2-core
>= 2.5.0, <= 2.5.33
MAVEN / org.apache.struts:struts2-core
>= 2.0.0, <= 2.3.37

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

AFFECTED PACKAGES:
Unknown / Unknown
57 versions affected
ALIASES:
GHSA-qcfc-hmrc-59x7

> NUCLEI TEMPLATES

Des templates Nuclei sont disponibles pour scanner cette vulnérabilité.

🎯
CVE-2025-68493.yaml
http/cves/2025/CVE-2025-68493.yaml
Usage: nuclei -t http/cves/2025/CVE-2025-68493.yaml -u target.com

> HISTORIQUE DES MODIFICATIONS

Première apparition
11/01/2026 13:15
Source: NVD
📊 ENRICHISSEMENT 01/02/2026 06:44
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-112: Missing XML Validation - The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
📊 ENRICHISSEMENT 19/01/2026 17:38
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/01/2026 05:02
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/01/2026 05:02
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 4 Dernière mise à jour: 9 months ago

> REFERENCES

https://cwiki.apache.org/confluence/display/WW/S2-069
« BACK_TO_HOME