Spring Security 身份验证缺陷漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://avd.aliyun.com/detail?id=AVD-2026-22732
• https://zhuanlan.zhihu.com/p/617888778
• https://blog.nsfocus.net/spring-securitycve-2023-34034/
• https://blog.csdn.net/m0_72965398/article/details/132562798
• https://www.secrss.com/articles/42765
• https://nic.seu.edu.cn/info/1047/1328.htm
• https://avd.aliyun.com/detail?id=AVD-2025-22235
• https://www.anquanke.com/post/id/279670
• https://it.shanghaitech.edu.cn/2024/0223/c8406a1088187/page.htm
• https://spring.io/security/cve-2025-22228
• https://www.secrss.com/articles/71883
• https://github.com/seata/seata/issues/6011
• https://avd.aliyun.com/detail?id=AVD-2025-22228
• https://www.venustech.com.cn/new_type/aqtg/20260320/29235.html

Related Vulnerabilities

• PoCCVE-2026-0561: Shield Security <= 21.0.8 - Unauthenticated Reflected XSS
• PoCCVE-2026-5032: W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure
• SpringBlade /api/blade-log/api/list SQL 注入漏洞
• SpringBlade /api/blade-user/list SQL 注入漏洞
• Spring Actuator 未授权访问漏洞
• Tattile Camera /api/v1/security/login 默认口令漏洞（CVE-2026-26341）
• PoCspringboot-sbom: Spring Boot Actuator SBOM - Exposure
• PoCCVE-2023-49438: Python Flask-Security-Too <=5.3.2 - Open Redirect
• PoCCVE-2025-41242: Spring Framework - Path Traversal
• PoCspringboot-httpexchanges: Detects Springboot HTTP Exchanges Actuator
• PoCCVE-2024-38819: Spring Framework Path Traversal in Functional Web Frameworks
• Rundeck /j_security_check 默认口令漏洞
• Pentaho /pentaho/j_spring_security_check 默认口令漏洞