CVE-2020-10199

Nexus Repository Manager 3 Vuln versions affectées : = 3.21.2 CVE-2020-10199, CVE-2020-10204, CVE-2020-11444 CVE-2020-10199 Exécution de commande à distance POC avec réponse POC sans réponse $\A''.getClass.forName'java.lang.Runtime'.getMethods6.invokenull.exec'touch /tmp/cve-2020-10199'...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2021-26084

CVE-2021-26084 CVE-2021-26084 - внедрение OGNL в Confluence...

CVE-2026-2586

인증된 GlassFish EL 주입 RCE CVE-2026-2586 GlassFish 관리 콘솔의 Expression Language 주입 취약점으로 인해 인증된 사용자가 관리 웹 인터페이스에서 처리되는 매개변수에 악성 EL 표현식을 주입할 수 있습니다. 성공적으로 악용하면 영향을 받는 서버에서 원격 명령 실행이 발생할 수 있습니다. 이 취약점은 서버 가상 구성 편집 흐름에서 발견되었으며, 여기서 사용자가 제어할 수 있는 매개변수가 애플리케이션에 의해 안전하지 않게 해석됩니다. 이는 다음 이유로 발생합니다: 관리 인터페이스는 ...

Linux Distros Unpatched Vulnerability : CVE-2026-104711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the...

CVE-2026-104711

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

EUVD-2026-92622

Improper neutralization of special elements used in an expression language statement 'Expression Language Injection' vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote co...

CVE-2020-13942byVulHub

CVE-2020-13942 от VulHub Apache Unomi Expression Language Injection RCE CVE-2020-13942 Описание Эта уязвимость позволяет выполнять произвольные команды в системах, работающих под управлением Apache Unomi версии 1.5.1, используя внедрение языка выражений MVEL. Страница проекта GitHub - Vulhub -...

PT-2026-106133

Name of the Vulnerable Software and Affected Versions Apache Struts versions 2.0.0 through 2.3.37 Apache Struts versions 2.5.0 through 2.5.33 Apache Struts versions 6.0.0 through 6.11.0 Apache Struts versions 7.0.0 through 7.3.0 Description An Expression Language Injection issue exists when the...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 и CVE-2025-4427 CVE-2025-4428 — это уязвимость удаленного выполнения кода после аутентификации в EPMM в DeviceFeatureUsageReportQueryRequestValidator. Она возникает из-за небезопасной обработки пользовательского ввода в сообщениях об ошибках, обрабатываемых через AbstractMessageSour...

cve-2022-42889-text4shell

Установка maven - maven-linux 1. Установка Maven для создания fat jar mvn clean install 2. Сборка Docker docker build --tag=text4shell . 3. Запуск Docker docker run -p 80:8080 text4shell 4. Проверьте приложение http://localhost/text4shell/attack?search= 5. Атака может быть выполнена путём передач...

CVE-2026-22738

Среда воспроизведения CVE-2026-22738 Описание уязвимости CVE-2026-22738 — это уязвимость внедрения SpEL Spring Expression Language в Spring AI SimpleVectorStore, которая может привести к неаутентифицированному удалённому выполнению кода RCE. Затронутые версии Артефакт| Затронутые версии|...

CVE-2017-8046-DEMO

spring data rest CVE-2017-8046 демонстрационный тест пожалуйста, ОБНОВИТЕ spring data rest СЕЙЧАС. шаги Запустите это приложение Создайте тестовый экземпляр POST /entityPersons/ HTTP/1.1 Host: localhost:8080 Content-Type: application/json Cache-Control: no-cache "firstName":"f2" Используя...

CVE-2026-87830: Improper Neutralization of Special Elements used in an Expression Language Statement

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...

PT-2026-99374

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.16.0 through 1.19.0 Description The software registers the globalcontext.Lib Common Expression Language CEL library in its policy environment without restricting it to the policy's namespace. This differs from other librarie...

CVE-2026-91145: Improper Neutralization of Special Elements used in an Expression Language Statement

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with that are stored and later evaluated in the full Spring context when a mail task uses variable-backed...

CVE-2026-77939

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939

Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...