CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
196 vulnerabilities with CWE-917
CVE-2026-11561
CRITICAL
SSTI in Soagen Informatics' Apinizer
CVSS 9.8
CVE-2026-40985
MEDIUM
Spring Web Flow 2.5.0-2.5.1, 3.0.0-3.0.1, 4.0.0 - Unified EL Injection
CVSS 6.4
CVE-2026-41729
HIGH
Spring Data REST SpEL Injection via Map Key in JSON Patch
CVSS 8.1
CVE-2026-41719
MEDIUM
Spring Data KeyValue and Redis - SpEL Injection in SpelPropertyComparator
CVSS 6.4
CVE-2026-41717
HIGH
Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
CVSS 8.1
CVE-2026-8888
HIGH
Securly Chrome Extension < 3.0.7 - Denial of Service
CVSS 7.5
CVE-2026-2587
CRITICAL
Eclipse Glassfish - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVSS 9.6
CVE-2026-2586
CRITICAL
Eclipse Glassfish - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVSS 9.1
CVE-2026-31380
MEDIUM
Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass
CVSS 6.5
CVE-2026-26462
HIGH
Offline Hospital Management System 5.3.0 - Remote Code Execution
CVSS 7.3
CVE-2026-8759
HIGH
xiandafu beetl SpELFunction SpELFunction.java expression language injection
CVSS 7.3
CVE-2026-41901
CRITICAL
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
CVSS 9.0
CVE-2026-41705
HIGH
Spring AI - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CVSS 8.6
CVE-2026-41883
HIGH
OmniFaces: EL injection via crafted resource name in wildcard CDN mapping
CVSS 8.1
CVE-2026-28201
HIGH
SurrealDB Injection on Open Notebook
CVSS 7.8
CVE-2026-42811
CRITICAL
Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions
CVSS 9.9
CVE-2026-40478
CRITICAL
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf
CVSS 9.0
CVE-2026-40477
CRITICAL
Improper restriction of the scope of accessible objects in Thymeleaf expressions
CVSS 9.0
CVE-2026-39842
CRITICAL
OpenRemote is Vulnerable to Expression Injection
CVSS 9.9
CVE-2026-22738
CRITICAL
SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
CVSS 9.8
CVE-2026-22729
HIGH
CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter
CVSS 8.6
CVE-2026-24713
CRITICAL
Apache IoTDB 1.0.0-1.3.6/2.0.0-2.0.6 - Input Validation
CVSS 9.8
CVE-2025-11175
HIGH
Mediawiki - DiscussionTools Extension <1.44-1.43 - Code Injection
CVE-2025-41253
HIGH
Spring Cloud Gateway Server Webflux - Info Disclosure
CVSS 7.5
CVE-2025-41243
CRITICAL
Spring Cloud Gateway Server Webflux - Info Disclosure
CVSS 10.0
Details
Vulnerabilities
196