CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 Confluence OGNL 注入...

CVE-2020-10199

Nexus Repository Manager 3 Vuln 影响版本：= 3.21.2 CVE-2020-10199、CVE-2020-10204、CVE-2020-11444 CVE-2020-10199 远程代码命令执行 回显poc 不回显poc $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199' 普通用户权限 root@kitploit: /service/rest/beta/repositories/go/group 需要管理员权限 1...

CVE-2020-13942byVulHub

CVE-2020-13942byVulHub Apache Unomi 表达式语言注入 RCE CVE-2020-13942 描述 该漏洞允许在运行 Apache Unomi 1.5.1 版本的系统上，通过利用 MVEL 表达式语言注入来执行任意命令。 项目页面 GitHub - Vulhub - Unomi CVE-2020-13942 环境配置 Docker Compose 文件 docker-compose.yml root@kitploit: version: '2' services: web: image: vulhub/unomi:1.5.1 ports: -...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 demo de prueba por favor, ACTUALIZA spring data rest AHORA. pasos Inicia esta aplicación Crea una instancia de prueba root@kitploit: POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" Usando...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2026-22738

CVE-2026-22738 复现环境 漏洞描述 CVE-2026-22738 是 Spring AI SimpleVectorStore 中的 SpEL Spring Expression Language 注入漏洞，可导致未经身份验证的远程代码执行 RCE。 受影响版本 Artifact| 受影响版本| 修复版本 ---|---|--- org.springframework.ai:spring-ai-core| 1.0.0 – 1.0.4| 1.0.5 org.springframework.ai:spring-ai-core| 1.1.0-M1 – 1.1.3| 1.1.4 注意...

CVE-2026-2586

经过身份验证的GlassFish EL注入RCE（CVE-2026-2586） GlassFish管理控制台中存在一个表达式语言注入漏洞，允许经过身份验证的用户将恶意的EL表达式注入到管理Web界面处理的参数中。成功利用该漏洞可能导致在受影响服务器上远程执行命令。 该漏洞在服务器虚拟配置编辑流程中被发现，在此流程中，用户可控的参数被应用程序不安全地解释。 原因如下： 管理界面在处理EL表达式时使用了用户可控的参数。 输入在后端解释之前未经过适当的验证或清理。 管理控制台中经过身份验证的用户可以滥用此漏洞行为来调用Java类和方法。...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 是 EPMM 的 DeviceFeatureUsageReportQueryRequestValidator 中的一个认证后远程代码执行漏洞。该漏洞源于对用户提供的输入在通过 Spring 的 AbstractMessageSource 处理的错误消息中进行了不安全处理，从而导致攻击者可控的 EL（表达式语言）注入。在 /api/v2/featureusage 端点中使用精心构造的 format 参数会导致任意 Java 代码执行，已通过命令注入（例如 Runtime.exec）得到确认。...

cve-2022-42889-text4shell

安装 Maven - maven-linux 1. Maven 安装以创建 fat jar root@kitploit: mvn clean install 2. Docker 构建 root@kitploit: docker build --tag=text4shell . 3. Docker 运行 root@kitploit: docker run -p 80:8080 text4shell 4. 测试应用 root@kitploit: http://localhost/text4shell/attack?search= 5...

CVE-2026-77939

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939

Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...

EUVD-2026-67837

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

PT-2026-83281

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...

UBUNTU-CVE-2026-59283

Applications that evaluate Spring Expression Language SpEL expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring...

EUVD-2026-66854

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

pwnfaces

😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...

CVE-2026-41849

CVE-2026-41849...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...