CVE-2020-10199

CVE-2020-10199 Previously, during a penetration test, I encountered a target environment that had Nexus Repository Manager deployed. After stepping on some pitfalls, I finally managed to get a shell. I'll make a brief record here so it's easier to review later if needed. Target version: Sonatype...

CVE-2022-22947

CVE-2022-22947 poc for CVE-2022-22947 python CVE-202222947POC.py http://targetip:port/ Refer to POCs and articles from several experts 1.https://github.com/chaosec2021/CVE-2022-22947-POC 2.https://y4er.com/post/cve-2022-22947-springcloud-gateway-spel-rce-echo-response/...

SpringCloudFunction-Research

SpringCloudFunction-Research CVE-2022-22963 research Environment vulfocus/spring-cloud-function-rce:latest Cause Parsing issue of the spring.cloud.function.routing-expression parameter in the Request Header, leading to injection Payload attacks. Reference...

CVE-2022-22963-Exploit

CVE-2022-22963 Exploit This repository contains a Rust-based exploit for the CVE-2022-22963 vulnerability found in Spring Cloud Function versions 3.1.6, 3.2.2, and older unsupported versions. The vulnerability allows remote code execution and access to local resources through a specially crafted...

CVE-2022-22963

Spring Cloud Function VulnerabilityCVE-2022-22963 Vulnerable Application to CVE-2022-22963 CVE-2022-22963 Exploit Demo https://user-images.githubusercontent.com/57348147/161266562-51d025f0-54d4-488f-ac50-2317e29bfbdf.mp4 Build docker pull me2nuk/cves:2022-22963 docker run -it -p 8080:8080...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 2.5 Vulnerability Details CVEID:CVE-2016-1000027 DESCRIPTION: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data...

spring-spel-0day-poc

spring-spel-0day-poc spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header spring.cloud.function.routing-expression:Tjava.lang.Runtime.getRuntime.exec"open -a calculator.app" build wget...

CLEANSTART-2026-GV33004 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

CLEANSTART-2026-BI57203 SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator

Security vulnerability affects the apache-nifi package. A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator...

Security Bulletin: Vulnerabilities in Netty,Apache Log4j Core,Spring Boot,Spring Framework,PostCSS,tmp,Spring Data,Apache Commons Lang,React Router,Bootstrap,d3-color might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Netty, Apache Log4j Core, Spring Boot, Spring Framework, PostCSS, tmp, Spring Data, Apache Commons Lang, React Router, Bootstrap,d3-color. Vulnerabilities include The attacker can present a server certificate...

CVE-2026-41717

A flaw was found in Spring Data MongoDB. A remote attacker can exploit a SpEL Spring Expression Language expression injection vulnerability. This issue arises during parameter binding when a user-defined repository query method is annotated with @Query and uses a capture-all placeholder. Successf...

CVE-2026-63337 vulnerabilities

Vulnerabilities for packages: zipkin, logstash, conductor, traccar-fips, thingsboard, cassandra-reaper, traccar, nuxeo, conductor-fips, logstash-fips, druid...

SpEL Injection

Spring Data KeyValue / Spring Data Redis is vulnerable to SpEL Injection. The vulnerability is due to unsanitized Sort input being evaluated by SpelPropertyComparator, allowing an attacker to inject and execute malicious SpEL expressions...

Expression Language (SpEL) Injection

Spring Data MongoDB is vulnerable to Expression Language SpEL Injection. The vulnerability is due to improper handling of user-supplied values during parameter binding in @Query repository methods using a capture-all placeholder, which allows an attacker to inject and execute malicious SpEL...

DoS (Denial of Service) org.springframework:spring-expression Dependency in Bamboo Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 12.0.0, and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to...

K000162341: Multiple Spring framework vulnerabilities

Security Advisory Description CVE-2026-41837 Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19;...

K000162085: Spring Data MongoDB vulnerability CVE-2026-41717

Security Advisory Description Spring Data MongoDB contains a SpEL Spring Expression Language expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions...

K000161950: Spring AI vulnerability CVE-2026-22738

Security Advisory Description In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStore and pass user-supplied...

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch requests

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch application/json-patch+json requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL...

Spring Data KeyValue: Remote code execution via SpEL Injection in Sort-based repository queries

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through...