Hutool

CVE-2025-56769 Sep 25, 23:15 Maven MEDIUM POC PATCH This Month

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-51080 Dec 27, 21:15 Maven HIGH POC PATCH This Week

The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-51075 Dec 27, 21:15 Maven HIGH POC PATCH This Week

hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-42278 Sep 08, 22:15 Maven HIGH POC PATCH This Week

hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse(). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-42277 Sep 08, 22:15 Maven CRITICAL POC Act Now

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-42276 Sep 08, 22:15 Maven CRITICAL POC Act Now

hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-3276 Jun 15, 13:15 Maven HIGH POC This Week

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-33695 Jun 13, 16:15 Maven HIGH POC PATCH This Week

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-24163 Jan 31, 16:15 Maven CRITICAL POC PATCH Act Now

SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2023-24162 Jan 31, 16:15 Maven CRITICAL POC Act Now

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-4565 Dec 16, 19:15 Maven HIGH POC PATCH This Week

A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-45690 Dec 13, 15:15 Maven HIGH POC PATCH This Week

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-45689 Dec 13, 15:15 Maven HIGH POC This Week

hutool-json v5.8.10 was discovered to contain an out of memory error. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2022-45688 Dec 13, 15:15 Maven HIGH POC PATCH This Week

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2018-17297 Sep 21, 07:29 Maven HIGH PATCH This Week

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.