CWE-608
Struts: Non-private Field in ActionForm Class
An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
Impactr finds and proves whether CWE-608 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.