Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2026-2586

Authenticated GlassFish EL Injection RCE CVE-2026-2586 An Expression Language Injection vulnerability in the GlassFish Administration Console allows an authenticated user to inject malicious EL expressions into parameters processed by the administrative web interface. Successful exploitation may...

CVE-2025-4427-CVE-2025-4428

CVE-2025-4428 & CVE-2025-4427 CVE-2025-4428 is a post-auth remote code execution vulnerability in EPMM's DeviceFeatureUsageReportQueryRequestValidator. It arises from the unsafe handling of user-supplied input within error messages processed via Spring’s AbstractMessageSource, which allows...

Security Bulletin: Hibernate Validator is affected by an expression language injection vulnerability (CVE-2026-93879)

Summary Hibernate Validator is affected by an expression language injection vulnerability. Vulnerability Details CVEID:CVE-2026-93879 DESCRIPTION: Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escapi...

Expression Language Injection

Apache Camel is vulnerable to Expression Language Injection. The vulnerability is due to improper validation of expression language inputs, where DynamicRouterControlService resolves the language from the CamelContext and compiles the expression into a Predicate without any allow‑list, and an...

CVE-2026-83531

CVE-2026-83531 — camel-dynamic-router: control-endpoint expression-language injection Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the dynamic-router-control endpoint took the subscription predicate and the name of the language used to compile it from the incoming...

CVE-2024-4412 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language EL code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges...

CVE-2024-4412

Multiple WSO2 products are vulnerable to Expression Language (EL) injection because the software fails to sufficiently validate user-supplied data. This flaw allows an attacker with administrator privileges to inject malicious EL code and execute arbitrary operations within the affected deploymen...

CVE-2026-83531

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

CVE-2026-83531 Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

CVE-2026-83531 Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

CVE-2026-83531 Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

CVE-2026-83531

Apache Camel's dynamic-router-control endpoint is vulnerable to Code Injection (CWE-94) and Expression Language Injection (CWE-917). The component improperly takes the subscription predicate and expression language name directly from incoming control messages (via predicate/expressionLanguage fie...

EUVD-2026-104212

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

Exploit for CVE-2026-83531

CVE-2026-83531 — camel-dynamic-router: control-endpoint expres...

PT-2026-117340

Improper Control of Generation of Code 'Code Injection', Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache Camel. This issue affects Apache Camel: from 4.4.0 before 4.18.5, from 4.19.0 before 4.22.1. The...

Exploit for Expression Language Injection in Apache Struts

CVE-2026-1047...

Exploit for Expression Language Injection in Apache Struts

CVE-2026-10471...

Exploit for Expression Language Injection in Apache Struts

CVE-202...

Expression Language Injection

Overview org.hibernate.validator:hibernate-validator is a Hibernate Validator Engine Relocation Artifact. Affected versions of this package are vulnerable to Expression Language Injection in the ParameterTermResolver class, whose resolveExpression method converts a message parameter value to a...