CVE-2026-105111

A flaw was found in Apache Commons BCEL. The Class2HTML component does not properly sanitize strings when generating web pages from Java class files. A remote attacker can supply a specially crafted class file to trigger stored Cross-Site Scripting XSS when a user views the generated report...

CVE-2026-94114

A flaw was found in Apache Commons BCEL Byte Code Engineering Library. When loading untrusted classes, the library caches them under their internally declared names without verifying them against the requested class name. A remote attacker could exploit this vulnerability to substitute legitimate...

Linux Distros Unpatched Vulnerability : CVE-2026-105111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using...

DEBIAN-CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

EUVD-2026-93972

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-105111

The Apache Commons BCEL library is vulnerable to a stored cross-site scripting (XSS) flaw in versions before 6.13.0 . The issue occurs when using the Class2HTML component to generate webpages from potentially attacker-controlled class files. Specifically, the Class2HTML emitters fail to properly ...

CVE-2026-105111 Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings in...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

CVE-2026-94114

Apache Commons BCEL versions before 6.13.0 are vulnerable to a symbolic name mapping issue. The BCEL component caches attacker-controlled classes using self-declared names without sufficient validation. This flaw allows subsequent lookups and name-keyed verification results to point to different ...

CVE-2026-94114 Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Symbolic name not mapping to correct class. BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class. This issue affects Apache Commons BCEL: before...

PT-2026-107178

Name of the Vulnerable Software and Affected Versions Apache Commons BCEL versions prior to 6.13.0 Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. This occurs when...

Rocky Linux 9 [CIQ] Security Update: bcel (crlsa-2023_0005)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20230005 advisory. Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing CVE-2022-42920 Tenable has extracted the preceding description block directly from the CI...

Astra Linux – Vulnerability in bcel

Apache Commons BCEL includes several APIs that typically only allow modifying specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to generate arbitrary bytecode. This could lead to abuse in applications that send attacker-controllable data to tho...

TencentOS Server 2: bcel (TSSA-2022:0287)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0287 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerability in Apache Commons BCEL

Summary SPSS Collaboration and Deployment Services is affected by vulnerability in Apache Commons BCEL. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2022-42920 DESCRIPTION: Apache Commons BCEL could allow a remote attacker to bypass security restrictions,...