References https://spring.io/security/cve-2022-22965 https://www.picussecurity.com/resource/spring4shell-spring-core-remote-code-execution-vulnerability https://blog.qualys.com/vulnerabilities-threat-research/2022/03/31/spring-framework-zero-day-remote-code-execution-spring4shell-vulnerability https://www.praetorian.com/blog/spring-core-jdk9-rce/ https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/ https://access.redhat.com/security/vulnerabilities/RHSB-2022-003 https://www.huaweicloud.com/notice/2022/20220401024146321.html https://developer.aliyun.com/article/1338406 https://ic.tcu.edu.cn/info/2421/2323.htm https://blog.nsfocus.net/cve-2022-22965/ https://github.com/NewBeginning6/spring-Framework-rce
Related VulnerabilitiesPoCCVE-2026-39352: Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path TraversalPoCfrappe-default-login: Frappe Framework - Default Login CredentialsSpringBlade /api/blade-log/api/list SQL 注入漏洞SpringBlade /api/blade-user/list SQL 注入漏洞Spring Actuator 未授权访问漏洞PoCspringboot-sbom: Spring Boot Actuator SBOM - ExposurePoCCVE-2025-41242: Spring Framework - Path TraversalPoCspringboot-httpexchanges: Detects Springboot HTTP Exchanges ActuatorPoCCVE-2024-38819: Spring Framework Path Traversal in Functional Web FrameworksPentaho /pentaho/j_spring_security_check 默认口令漏洞PoCCVE-2026-22739: Spring Cloud Config Server - Path TraversalPoCspringboot-x-application-context: Spring Boot `X-Application-Context` Header ExposureServerless Framework 未授权 命令注入漏洞