CVE-2025-68613

CVE-2025-68613 n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Execution RCE vulnerability in their workflow expression evaluation system. Under certain conditions, expressions supplied by...

cve-2022-26134

cve-2022-26134 cve-2022-26134 atlassia Confluence Data Center2016 server OGNL %...

cve-2022-42889-text4shell

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

CVE-2020-17531

CVE-2020-17530 Apache Struts2 framework is a web framework for developing Java EE web applications. Apache Struts disclosed S2-061 Struts remote code execution vulnerability CVE-2020-17530 on December 08, 2020. When using certain tags and other cases, there may be an OGNL expression injection...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...

CVE-2026-95664

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2026-95664

The Apache Camel aws2-s3 component is vulnerable to an Expression Language Injection (CWE-917) in versions 4.8.0 to 4.18.4 , 4.19.0 to 4.22.1 , and 4.23.0 (Note: the document states the issue is fixed in 4.18.5, 4.22.2, and 4.23.0). The root cause is that AWS2S3Utils.determineKey() evaluates valu...

CVE-2026-95664 Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2026-95664 Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

EUVD-2026-109668

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2024-28784

CVE-2024-28784 — Stored XSS in IBM QRadar SIEM Rule Wizard 🛠 Product Information Vendor: IBM Product: IBM Security QRadar SIEM Affected Version: 7.5.0 UpdatePackage 7 Build 20230822112654 Component: Rule Wizard Regular Expression Logic Block CVE ID: CVE-2024-28784 🐞 Vulnerability Summary A stored...

CVE-2023-32571

🐞 CVE-2023-32571 - System.Linq.Dynamic.Core Remote Code Execution Proof of Concept for CVE-2023-32571, a remote code execution vulnerability in System.Linq.Dynamic.Core 1.0.7.10 to 1.2.25. This vulnerability allows attackers to execute arbitrary code and commands when untrusted input to methods...

CVE-2019-19204

CVE-2019-19204 An issue was discovered in Oniguruma 6.x before 6.9.4rc2. In the function fetchintervalquantifier formerly known as fetchrangequantifier in regparse.c, PFETCH is called without checking PEND. This leads to a heap-based buffer over-read. Researcher: ManhND of The Tarantula Team,...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test please UPGRADE spring data rest NOW. steps 启动本应用 创建test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用spel注入, 会启动C:\Windows\system32\calc.exe PATCH /entityPersons/1...

SpringCloudFunction-Research

SpringCloudFunction-Research CVE-2022-22963 research Environment vulfocus/spring-cloud-function-rce:latest Cause Parsing issue of the spring.cloud.function.routing-expression parameter in the Request Header, leading to injection Payload attacks. Reference...

Exploit-CVE-2025-68613

Exploit-CVE-2025-68613 Security Advisory: Critical Remote Code Execution Vulnerability in n8n CVE-2025-68613 A critical vulnerability has been identified in the n8n workflow automation tool that allows for arbitrary code execution. Authenticated users with permissions to create or edit workflows...

ROOT-APP-MAVEN-CVE-2026-41850 CVE-2026-41850 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2026-41850 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

n8n - Remote Code Execution via Expression Injection

n8n 1.120.4, 1.121.1, 1.122.0 contains a remote code execution caused by insufficient isolation in workflow expression evaluation, letting authenticated attackers execute arbitrary code with n8n process privileges. Exploit requires authentication. id: CVE-2025-68613 info: name: n8n - Remote Code...

Linux Distros Unpatched Vulnerability : CVE-2026-89078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain...

Linux Distros Unpatched Vulnerability : CVE-2026-113877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolat...