CVE-2018-11039Medium· 5.9▾ SunlitSpring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilt…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.8%
Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
spring_framework < 4.3.18spring_framework >= 5.0.0, < 5.0.7agile_product_lifecycle_management = 9.3.3agile_product_lifecycle_management = 9.3.4agile_product_lifecycle_management = 9.3.5agile_product_lifecycle_management = 9.3.6application_testing_suite = 12.5.0.3application_testing_suite = 13.1.0.1application_testing_suite = 13.2.0.1application_testing_suite = 13.3.0.1communications_diameter_signaling_router < 8.3communications_network_integrity >= 7.3.2, <= 7.3.6communications_online_mediation_controller = 6.1communications_performance_intelligence_center < 10.2.1communications_services_gatekeeper < 6.1.0.4.0communications_unified_inventory_management = 7.3.2communications_unified_inventory_management = 7.3.4communications_unified_inventory_management = 7.3.5communications_unified_inventory_management = 7.4.0endeca_information_discovery_integrator = 3.1.0endeca_information_discovery_integrator = 3.2.0enterprise_manager_base_platform = 12.1.0.5.0enterprise_manager_base_platform = 13.2.0.0.0enterprise_manager_base_platform = 13.3.0.0.0enterprise_manager_for_mysql_database = 13.2enterprise_manager_ops_center = 12.3.3health_sciences_information_manager = 3.0healthcare_master_person_index = 3.0healthcare_master_person_index = 4.0hospitality_guest_access = 4.2.0hospitality_guest_access = 4.2.1insurance_calculation_engine >= 11.0.0, <= 11.3.1insurance_calculation_engine = 10.2insurance_rules_palette = 10.0insurance_rules_palette = 10.2micros_lucas = 2.9.5mysql_enterprise_monitor <= 3.4.9.4237mysql_enterprise_monitor >= 4.0.0, <= 4.0.6.5281mysql_enterprise_monitor >= 8.0.0, <= 8.0.2.8191primavera_p6_enterprise_project_portfolio_management = 18.8retail_advanced_inventory_planning = 15.0retail_assortment_planning = 14.1retail_assortment_planning = 15.0retail_assortment_planning = 16.0retail_clearance_optimization_engine = 14.0.5retail_customer_insights = 15.0retail_customer_insights = 16.0retail_financial_integration = 13.2retail_financial_integration = 14.0retail_financial_integration = 14.1retail_financial_integration = 15.0retail_financial_integration = 16.0retail_integration_bus = 14.1.2retail_markdown_optimization = 13.4.4retail_predictive_application_server = 14.0.3.26retail_predictive_application_server = 14.1.3.37retail_predictive_application_server = 15.0.3..100retail_predictive_application_server = 16.0retail_xstore_point_of_service = 7.1utilities_network_management_system = 1.12.0.3weblogic_server = 10.3.6.0.0weblogic_server = 12.1.3.0.0weblogic_server = 12.2.1.3.0debian_linux = 9.0Upgrade past the affected range:
spring_framework 5.0.7communications_diameter_signaling_router 8.3communications_performance_intelligence_center 10.2.1communications_services_gatekeeper 6.1.0.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2018-15756High· 7.5Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRe…
CVE-2026-47885High· 7.5The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28
CVE-2026-47889High· 7.5A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
CVE-2026-47883Medium· 6.1UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
CVE-2026-47884Critical· 9.8Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spr…
CVE-2026-47886High· 7.5Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent…