Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 ist eine post-authentifizierte Remote-Code-Ausführungsschwachstelle im DeviceFeatureUsageReportQueryRequestValidator von EPMM. Sie entsteht durch unsichere Handhabung von Benutzereingaben in Fehlermeldungen, die über Springs AbstractMessageSource...

CVE-2020-10199

Nexus Repository Manager 3 Vulnerabilidade Versões afetadas: = 3.21.2 CVE-2020-10199, CVE-2020-10204, CVE-2020-11444 CVE-2020-10199 Execução Remota de Comandos POC com retorno POC sem retorno $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199' Permissã...

CVE-2021-26084

CVE-2021-26084 Injeção OGNL no Confluence CVE-2021-26084...

cve-2022-42889-text4shell

Maven स्थापित करें - maven-linux 1. फैट जार बनाने के लिए Maven स्थापित करें mvn clean install 2. Docker बिल्ड docker build --tag=text4shell . 3. Docker चलाएँ docker run -p 80:8080 text4shell 4. ऐप का परीक्षण करें http://localhost/text4shell/attack?search= 5. हमला एक स्ट्रिंग “$prefix:name” पास कर...

CVE-2026-22738

Ambiente de Reprodução do CVE-2026-22738 Descrição da Vulnerabilidade O CVE-2026-22738 é uma vulnerabilidade de injeção SpEL Spring Expression Language no SimpleVectorStore do Spring AI, que pode levar à execução remota de código RCE não autenticada. Versões Afetadas Artifact| Versões Afetadas|...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test por favor, ATUALIZE o spring data rest AGORA. Passos Inicie este aplicativo Crie uma instância de teste POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" Usando injeção de spel, o...

CVE-2026-2586

RCE por Injeção de EL Autenticada no GlassFish CVE-2026-2586 Uma vulnerabilidade de Injeção de Expression Language no Console de Administração do GlassFish permite que um usuário autenticado injete expressões EL maliciosas em parâmetros processados pela interface web administrativa. A exploração...

Linux Distros Unpatched Vulnerability : CVE-2026-104711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Improper Control of Dynamically-Managed Code Resources (CVE-2026-59283)

Summary Spring MVC application evaluate Spring Expression Language SpEL which used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar Vulnerability Details CVEID:CVE-2026-59283 DESCRIPTION: Applications that evaluate Spring Expression Language SpEL expressions...

Security Bulletin: Due to the use of Spring Expression Language (SpEL), IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-47886)

Summary Spring Expression Language SpEL is used by IBM Sterling Control Center as part of dependency in spring-expression-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-47886 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

EUVD-2026-92622

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2020-13942byVulHub

CVE-2020-13942byVulHub Apache Unomi Expression Language Injection RCE CVE-2020-13942 Beschreibung Diese Schwachstelle ermöglicht die Ausführung beliebiger Befehle auf Systemen, die Apache Unomi Version 1.5.1 ausführen, indem sie die MVEL-Ausdrückssprachen-Injection ausnutzt. Projektseite GitHub -...

CVE-2026-104711: Improper Neutralization of Special Elements used in an Expression Language Statement

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

PT-2026-106133

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An Expression Language Injection issue exists when the...

Exploit for Expression Language Injection in Redhat Richfaces

RichFaces Paint2DResource — CVE-2018-12533 CTF lab A self-con...

CLEANSTART-2026-QE04836 vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker t...

Security vulnerability affects the apache-nifi package. A vulnerability in Spring Expression Language SpEL evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic...

CVE-2026-87830: Improper Neutralization of Special Elements used in an Expression Language Statement

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

PT-2026-99374

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.16.0 through 1.19.0 Description The software registers the globalcontext.Lib Common Expression Language CEL library in its policy environment without restricting it to the policy's namespace. This differs from other librarie...