CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 Confluence OGNL injection...

CVE-2026-22738

CVE-2026-22738 Reproduction Environment Vulnerability Description CVE-2026-22738 is a SpEL Spring Expression Language injection vulnerability in Spring AI SimpleVectorStore that can lead to unauthenticated remote code execution RCE. Affected Versions Artifact| Affected Versions| Fixed Versions...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo test please UPGRADE spring data rest NOW. steps 启动本应用 创建test instance POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" 利用spel注入, 会启动C:\Windows\system32\calc.exe PATCH /entityPersons/1...

CVE-2026-83531

CVE-2026-83531 — camel-dynamic-router: control-endpoint expression-language injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the dynamic-router-control endpoint took the subscription predicate and the name of the language used to compile it from the incoming...

cve-2022-42889-text4shell

Install maven - maven-linux 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080 text4shell 4. Test the app http://localhost/text4shell/attack?search= 5. Attack can be performed by passing a string...

CVE-2020-10199

Nexus Repository Manager 3 Vuln Affected versions: = 3.21.2 CVE-2020-10199, CVE-2020-10204, CVE-2020-11444 CVE-2020-10199 Remote Code Execution Echo PoC No Echo PoC $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199' Normal User Privileges...

CVE-2026-2586

Authenticated GlassFish EL Injection RCE CVE-2026-2586 An Expression Language Injection vulnerability in the GlassFish Administration Console allows an authenticated user to inject malicious EL expressions into parameters processed by the administrative web interface. Successful exploitation may...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2020-13942byVulHub

CVE-2020-13942byVulHub Apache Unomi Expression Language Injection RCE CVE-2020-13942 Description This vulnerability allows arbitrary command execution on systems running Apache Unomi version 1.5.1, by exploiting MVEL expression language injection. Project Page GitHub - Vulhub - Unomi CVE-2020-139...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...

CVE-2026-95664

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2026-95664 Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2026-95664 Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2026-95664

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

EUVD-2026-109668

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CVE-2026-95664

The Apache Camel aws2-s3 component is vulnerable to an Expression Language Injection (CWE-917) in versions 4.8.0 to 4.18.4 , 4.19.0 to 4.22.1 , and 4.23.0 (Note: the document states the issue is fixed in 4.18.5, 4.22.2, and 4.23.0). The root cause is that AWS2S3Utils.determineKey() evaluates valu...

PT-2026-123182

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes,...

CLEANSTART-2026-UK84272 Expr is an expression language and expression evaluation for Go

Security vulnerability affects the argo-cd package. Expr is an expression language and expression evaluation for Go...

Security Bulletin: Hibernate Validator is affected by an expression language injection vulnerability (CVE-2026-93879)

Summary Hibernate Validator is affected by an expression language injection vulnerability. Vulnerability Details CVEID:CVE-2026-93879 DESCRIPTION: Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escapi...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by the Hibernate Validator vulnerability Vulnerability Details CVEID:CVE-2026-93879 DESCRIPTION: Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper...