Back to the CVE list
CVE-2018-11776 CISA KEV · Actively exploited

struts2: Using specific results and namespaces can result in a remote code execution

CVSS score

9.8

EPSS probability

%100.0

Risk score

19.6

Published

8 y ago

OverviewPublic Exploits (14)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
m4sk0ff/CVE-2018-11776
GitHub

PoC Script for the CVE-2018-11776 vuln

Public PoCSource updated: 09.09.2025 13:40:00
G
jiguangsdf/CVE-2018-11776
GitHub

CVE-2018-11776(S2-057) EXPLOIT CODE

Public PoCSource updated: 09.05.2024 13:33:10
G
sonpt-afk/CVE-2018-11776-FIS
GitHub

sonpt-afk/CVE-2018-11776-FIS

Public PoCSource updated: 23.06.2023 03:12:07
G
OzNetNerd/apche-struts-vuln-demo-cve-2018-11776
GitHub

Spins up an isolated test environment for experimentation with Apache Struts vulnerability CVE-2018-11776.

Public PoCSource updated: 03.09.2020 00:46:46
G
cved-sources/cve-2018-11776
GitHub

cve-2018-11776

Public PoCSource updated: 15.04.2021 21:30:12
G
arlyone/Apache-Struts-0Day-Exploit
GitHub

Critical Remote Code Execution Vulnerability (CVE-2018-11776) Found in Apache Struts.

Public PoCSource updated: 07.09.2026 16:01:40
G
freshdemo/ApacheStruts-CVE-2018-11776
GitHub

freshdemo/ApacheStruts-CVE-2018-11776

Public PoCSource updated: 04.09.2023 14:39:51
G
xfox64x/CVE-2018-11776
GitHub

Creating a vulnerable environment and the PoC

Public PoCSource updated: 20.03.2023 13:29:20
G
cucadili/CVE-2018-11776
GitHub

Investigation of CVE-2018-11776 vulnerability that allows attackers to remotely execute code and gain control over Apache Struts-based applications.

Public PoCSource updated: 08.10.2019 23:46:28
G
Ekultek/Strutter
GitHub

Proof of Concept for CVE-2018-11776

Public PoCSource updated: 05.03.2025 11:11:20
E
Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)
Exploit-DB

Apache Struts 2 - Namespace Redirect OGNL Injection (Metasploit)

Exploit referenceSource updated: 10.09.2018 00:00:00
E
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)
Exploit-DB

Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (1)

Exploit referenceSource updated: 26.08.2018 00:00:00
E
Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)
Exploit-DB

Apache Struts 2.3 < 2.3.34 / 2.5 < 2.5.16 - Remote Code Execution (2)

Exploit referenceSource updated: 25.08.2018 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11776.yaml
Nuclei

Nuclei: Apache Struts2 S2-057 - Remote Code Execution

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2018-11776"