CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)

206 CVEs classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)). Browse by severity and year.

Top CVEs for CWE-917
CVESeverityScorePublishedSummary
CVE-2025-41243Critical10.02025-09-16Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the…
CVE-2022-22947Critical10.02022-03-03In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab…
CVE-2021-44228Critical10.02021-12-10Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter…
CVE-2026-42811Critical9.92026-05-04In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can…
CVE-2026-39842Critical9.92026-04-15OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that all…
CVE-2026-52439Critical9.82026-07-23An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism
CVE-2026-11561Critical9.82026-06-11Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Tech…
CVE-2026-22738Critical9.82026-03-27In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could…
CVE-2026-24713Critical9.82026-03-09Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recomme…
CVE-2023-51593Critical9.82024-05-03Voltronic Power ViewPower Pro Expression Language Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar…
CVE-2023-41331Critical9.82023-09-12SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achi…
CVE-2023-27821Critical9.82023-03-28Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter.
CVE-2023-26092Critical9.82023-02-20Liima before 1.17.28 allows server-side template injection.
CVE-2022-22980Critical9.82022-06-23A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain…
CVE-2022-26134Critical9.82022-06-03In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit…
CVE-2021-31805Critical9.82022-04-12The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation i…
CVE-2022-22963Critical9.82022-04-01In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall…
CVE-2021-26084Critical9.82021-08-30In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit…
CVE-2020-17530Critical9.82020-12-11Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts…
CVE-2020-7172Critical9.82020-10-19A templateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior…
All CVEs classified under CWE-917 — newest first (page 1 of 3)
CVESeverityScorePublishedSummary
CVE-2026-52439Critical9.82026-07-23An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism
CVE-2026-65591High8.82026-07-22n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modif…
CVE-2026-57281High7.52026-06-24Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing att…
CVE-2026-11561Critical9.82026-06-11Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Tech…
CVE-2026-40985Medium6.42026-06-11Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4…
CVE-2026-41729High8.12026-06-10Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. Whe…
CVE-2026-41719Medium6.42026-06-10A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates eva…
CVE-2026-41717High8.12026-06-10Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defi…
CVE-2026-8888High7.52026-06-03Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new R…
CVE-2026-44209High7.52026-05-26Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prom…
CVE-2026-2587Critical9.62026-05-19A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The a…
CVE-2026-2586Critical9.12026-05-19An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send craft…
CVE-2026-31380Medium6.52026-05-19Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This iss…
CVE-2026-26462High7.32026-05-18Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integ…
CVE-2026-8759High7.32026-05-17A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic-integration/beetl-spring-classic/src/m…
CVE-2026-41901Critical9.02026-05-12Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expr…
CVE-2026-41705High8.62026-05-09Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affecte…
CVE-2026-41883High8.12026-05-08OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Co…
CVE-2026-28201High7.82026-05-07An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimat…
CVE-2026-42811Critical9.92026-05-04In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can…
CVE-2026-40897High8.82026-04-24Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the e…
CVE-2026-40478Critical9.02026-04-17Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability i…
CVE-2026-40477Critical9.02026-04-17Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability i…
CVE-2026-39842Critical9.92026-04-15OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that all…
CVE-2026-34714Critical9.22026-03-30Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs w…
CVE-2026-33943High8.82026-03-27Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerabil…
CVE-2026-33938High8.12026-03-27Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored…
CVE-2026-32695High7.72026-03-27Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules by interpolating us…
CVE-2026-22738Critical9.82026-03-27In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could…
CVE-2026-22729High8.62026-03-18A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through…
CVE-2026-24713Critical9.82026-03-09Improper Input Validation vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7. Users are recomme…
CVE-2026-24737High8.12026-02-02jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitra…
CVE-2025-111752026-01-30Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundatio…
CVE-2025-41253High7.52025-10-16The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attacke…
CVE-2025-41243Critical10.02025-09-16Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the…
CVE-2025-33222025-06-06An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server.
CVE-2024-51466Critical9.02024-12-20IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote atta…
CVE-2024-127982024-12-19ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows …
CVE-2024-9672Medium5.42024-12-10A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the b…
CVE-2024-7552Medium6.32024-08-06A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression…
CVE-2024-5828High8.62024-08-06Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manage…
CVE-2024-4286Medium4.92024-05-26Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in th…
CVE-2023-51593Critical9.82024-05-03Voltronic Power ViewPower Pro Expression Language Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar…
CVE-2024-0715High7.62024-02-20Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: bef…
CVE-2023-42658High8.82023-10-31 Archive command in Chef InSpec prior to 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
CVE-2023-41331Critical9.82023-09-12SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achi…
CVE-2022-4146High7.32023-07-18Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replicat…
CVE-2022-45855High8.02023-07-12SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. User…
CVE-2022-42009High8.02023-07-12SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users…
CVE-2023-32200High8.82023-07-12There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a…
CVE-2023-22665Medium5.42023-04-25There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbi…
CVE-2023-20863Medium6.52023-04-13In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL expression that may c…
CVE-2023-27821Critical9.82023-03-28Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter.
CVE-2023-26092Critical9.82023-02-20Liima before 1.17.28 allows server-side template injection.
CVE-2022-23504Medium5.72022-12-14TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di…
CVE-2022-23463Critical9.42022-09-24Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is e…
CVE-2022-34466Medium6.52022-07-12A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix 9 (V9.12) (All vers…
CVE-2022-22980Critical9.82022-06-23A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain…
CVE-2022-26134Critical9.82022-06-03In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit…
CVE-2022-26111High8.82022-04-25The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an exist…
CVE-2022-24847High7.22022-04-13GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform a…
CVE-2022-24818High8.22022-04-13GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked J…
CVE-2021-31805Critical9.82022-04-12The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation i…
CVE-2022-22963Critical9.82022-04-01In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall…
CVE-2022-22947Critical10.02022-03-03In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enab…
CVE-2021-45046Critical9.02021-12-14It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers wi…
CVE-2021-44228Critical10.02021-12-10Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameter…
CVE-2021-32834High8.22021-09-09Eclipse Keti is a service that was designed to protect RESTfuls API using Attribute Based Access Control (ABAC). In Keti a user able to create Policy Sets can…
CVE-2021-26084Critical9.82021-08-30In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbit…
CVE-2020-26565High7.52021-07-31ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sens…
CVE-2021-28170Medium5.32021-05-26In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if the…
CVE-2020-17530Critical9.82020-12-11Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts…
CVE-2020-7195High8.82020-10-19A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior…
CVE-2020-7194High8.82020-10-19A perfaddormoddevicemonitor expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version…
CVE-2020-7193High8.82020-10-19A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s)…
CVE-2020-7192High8.82020-10-19A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s)…
CVE-2020-7191High8.82020-10-19A devsoftsel expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to i…
CVE-2020-7190High8.82020-10-19A deviceselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to…
CVE-2020-7189High8.82020-10-19A faultflasheventselectfact expression language injectionremote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(…
CVE-2020-7188High8.82020-10-19A userselectpagingcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s…
CVE-2020-7187High8.82020-10-19A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prio…
CVE-2020-7186High8.82020-10-19A powershellconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s…
CVE-2020-7185High8.82020-10-19A tvxlanlegend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to…
CVE-2020-7184High8.82020-10-19A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) ver…
CVE-2020-7183High8.82020-10-19A forwardredirect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior…
CVE-2020-7182High8.82020-10-19A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iM…
CVE-2020-7181High8.82020-10-19A smsrulesdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prio…
CVE-2020-7180High8.82020-10-19A ictexpertdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Pri…
CVE-2020-7179High8.82020-10-19A thirdpartyperfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(…
CVE-2020-7178High8.82020-10-19A mediaforaction expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior…
CVE-2020-7177High8.82020-10-19A wmiconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prio…
CVE-2020-7176High8.82020-10-19A viewtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(…
CVE-2020-7175High8.82020-10-19A iccselectdymicparam expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): P…
CVE-2020-7174High8.82020-10-19A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Pri…
CVE-2020-7173High8.82020-10-19A actionselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): P…
CVE-2020-7172Critical9.82020-10-19A templateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior…
CVE-2020-7171Critical9.82020-10-19A guidatadetail expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior t…
CVE-2020-7170Critical9.82020-10-19A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC P…
CVE-2020-7169Critical9.82020-10-19A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s)…
CVE-2020-7168Critical9.82020-10-19A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior…