CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 Confluence OGNL-Injection...

cve-2022-42889-text4shell

تثبيت maven - maven-linux 1. قم بتثبيت Maven لإنشاء الجرة الكبيرة fat jar root@kitploit: mvn clean install 2. بناء Docker root@kitploit: docker build --tag=text4shell . 3. تشغيل Docker root@kitploit: docker run -p 80:8080 text4shell 4. اختبر التطبيق root@kitploit:...

CVE-2026-2586

Authentifizierte GlassFish EL Injection RCE CVE-2026-2586 Eine Expression Language Injection-Schwachstelle in der GlassFish Administration Console ermöglicht es einem authentifizierten Benutzer, bösartige EL-Ausdrücke in Parameter einzuschleusen, die von der administrativen Weboberfläche...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2020-10199

Nexus Repository Manager 3 Schwachstellen Betroffene Versionen: = 3.21.2 CVE-2020-10199、CVE-2020-10204、CVE-2020-11444 CVE-2020-10199 Remote-Code-Befehlsausführung PoC mit Echo PoC ohne Echo $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199' Normale...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 e CVE-2025-4427 CVE-2025-4428 è una vulnerabilità di esecuzione remota di codice post-autenticazione in DeviceFeatureUsageReportQueryRequestValidator di EPMM. Deriva dalla gestione non sicura dell'input fornito dall'utente all'interno dei messaggi di errore elaborati tramite...

EUVD-2026-66854

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2020-13942byVulHub

CVE-2020-13942byVulHub Apache Unomi 표현 언어 주입 RCE CVE-2020-13942 설명 이 취약점은 MVEL 표현 언어 주입을 악용하여 Apache Unomi 1.5.1 버전을 실행하는 시스템에서 임의의 명령을 실행할 수 있게 합니다. 프로젝트 페이지 GitHub - Vulhub - Unomi CVE-2020-13942 환경 구성 Docker Compose 파일 docker-compose.yml root@kitploit: version: '2' services: web: image:...

CVE-2017-8046-DEMO

Test demo di spring data rest CVE-2017-8046 per favore AGGIORNA spring data rest ORA. passaggi Avvia questa applicazione Crea un'istanza di test root@kitploit: POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" Utilizzando...

CVE-2026-22738

Ambiente di riproduzione CVE-2026-22738 Descrizione della vulnerabilità CVE-2026-22738 è una vulnerabilità di iniezione SpEL Spring Expression Language in Spring AI SimpleVectorStore che può portare all'esecuzione remota di codice RCE non autenticata. Versioni interessate...

pwnfaces

😛 pwnfaces Exploit di iniezione EL in PrimeFaces 5.X 🕵️ Cos'è pwnfaces? 🕵️ pwnfaces è uno strumento Golang creato per sfruttare la vulnerabilità definita come CVE-2017-1000486 iniezione EL in PrimeFaces 5.X ⚡ Installazione / Per iniziare Una guida rapida su come installare e usare pwnfaces...

CVE-2026-41849

CVE-2026-41849...

Expression Language Injection

Spring Web Flow is vulnerable to Expression Language Injection. The vulnerability is due to malicious Unified EL expressions being processed by WebFlowELExpressionParser, allowing an attacker to execute arbitrary expressions in affected applications...

Security Bulletin:Vulnerability in spring affects IBM Netezza Appliance

Summary The spring package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-41850, CVE-2026-41851, CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL...

CVE-2026-17595 Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-17595

Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata...

CVE-2026-46581

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41850, CVE-2026-41851, CVE-2026-41852]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the details for remediation below...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-expression-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41850, CVE-2026-41851, CVE-2026-41852. Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

CVE-2026-41850

A flaw was found in Spring Framework. Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an Algorithmic Denial of Service DoS. A remote attacker can exploit this by providing a specially crafted expression, which triggers excessive resource...