CWE-917: EL Injection
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Also known as Improper Neutralization of Special Elements used in an Expression Language Statement, Expression Language Injection.
A kind of CWE-77 Command injection.
From the CWE List. © The MITRE Corporation.
Newest
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...9.8 Critical
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- hewlett packard enterprise hpe intelligent management center (imc) plat, hp intelligent management center +1 moreA remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC)...8.8 High
- qlik analytics, sense, qlikview server +2 moreAn issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11,...8.2 High
- zzzcms zzzphpAn issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the...7.2 High
- d-circle power eggInput validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and...9.8 Critical
- joomla joomla\!Joomla! Object Injection Vulnerability9.8 Critical
- sonatype nexus repository managerSonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.7.2 High
- redhat richfacesArbitrary code execution in Richfaces9.8 Critical
- redhat richfacesRichFaces vulnerable to Expression Language Injection9.8 Critical
- apache myfacesApache MyFaces Vulnerable to EL Injection7.5 High
- red hat jboss seam 2, redhat jboss enterprise application platform, netapp oncommand balance +2 more +4 moreJBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat...8.8 High
- apache tilesApache Tiles Vulnerable to XSS via EL Expression Injection6.8 Medium