CVE-2012-1006
Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.
- EPSS
- 57% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:struts
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cmpm-jg8r-fv37 | Maven | org.apache.struts:struts2-parent | <2.1.2 | 2.1.2 |
| GHSA-cmpm-jg8r-fv37 | Maven | org.apache.struts:struts2-parent | >=2.2 <2.2.3.1 | 2.2.3.1 |