CVE-2016-1182EPSS p98.0%

CVE-2016-1182CVE-2016-1182

apache / struts

Description

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.

Scoring

CVSS 8.2 ()
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS25.74% probability of exploitation · percentile 98.0% · 2026-10-17T12:00:28Z
Last modified2026-10-15
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.