org.noear vulnerabilities

Products

• org.noear/solon 2
• org.noear/solon-faas-luffy 1
• org.noear/solon-view 1
• org.noear/solon-web-staticfiles 1

Latest org.noear CVEs

Newest publication first

1. CVE-2025-46096 Solon Vulnerable to Directory Traversal

   Published 2025-06-13

   Medium·CVSS 6.1 EPSS 0.52%

   Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component

2. CVE-2025-2961 opensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversal

   Published 2025-03-30

   Medium·CVSS 5.3 EPSS 0.47%

   A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the component org.noear.solon.core.handle.RenderManager. The manipulation of the argument template with the input ../org/example/Hel...

3. CVE-2025-1584 opensolon Solon StaticMappings.java path traversal

   Published 2025-02-23

   Medium·CVSS 5.3 EPSS 0.57%

   A vulnerability classified as problematic was found in opensolon Solon up to 3.0.8. This vulnerability affects unknown code of the file solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java. The manipulation leads to path...

4. CVE-2023-48967 Solon is vulnerable to Deserialization of Untrusted Data

   Published 2023-12-04

   Critical·CVSS 9.8 EPSS 0.92%

   Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.

5. CVE-2023-35839 Solon vulnerable to deserialization of untrusted data

   Published 2023-06-19

   Critical·CVSS 9.8 EPSS 1.1%

   A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.