CWE-917— Improper Neutralization of Special Elements Used in an Expression Language Statement (EL Injection)
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.— MITRE CWE catalog
218 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-917page 5 of 5
- CVE-2019-9041HIGHCVSS 7.2EG 7.22019-02-23
An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.
- CVE-2018-16621HIGHCVSS 7.2EG 7.22018-11-15
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
- CVE-2026-91145HIGHCVSS 7.1EG 7.12026-09-14
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in …
- CVE-2009-1275MEDIUMCVSS v2 6.8EG 6.82009-04-09
Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtai…
- CVE-2026-31380MEDIUMCVSS 6.5EG 6.52026-05-19
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to v…
- CVE-2025-56769MEDIUMCVSS 6.5EG 6.52025-09-25
An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.
- CVE-2023-20861MEDIUMCVSS 6.5EG 6.52023-03-23
In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) c…
- CVE-2022-34466MEDIUMCVSS 6.5EG 6.52022-07-12
A vulnerability has been identified in Mendix Applications using Mendix 9 (All versions >= V9.11 < V9.15), Mendix Applications using Mendix 9 (V9.12) (All versions < V9.12.3). An expression injection vulnerability was discovered in the Wor…
- CVE-2026-40985MEDIUMCVSS 6.4EG 6.42026-06-11
Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.
- CVE-2026-41719MEDIUMCVSS 6.4EG 6.42026-06-10
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator. Affected versions: Spring Data KeyValue …
- CVE-2024-7552MEDIUMCVSS 6.3EG 6.32024-08-06
A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page…
- CVE-2024-12798MEDIUMCVSS 5.9EG 5.92024-12-19
ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logbac…
- CVE-2022-23504MEDIUMCVSS 5.7EG 5.72022-12-14
TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expression…
- CVE-2026-95664MEDIUMCVSS 5.4EG 5.42026-10-26
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19…
- CVE-2024-9672MEDIUMCVSS 5.4EG 5.42024-12-10
A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur.
- CVE-2023-22665MEDIUMCVSS 5.4EG 5.42023-04-25
There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
- CVE-2021-28170MEDIUMCVSS 5.3EG 5.32021-05-26
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
- CVE-2024-4286MEDIUMCVSS 4.9EG 4.92024-05-26
Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. The vulnerability arises…
Map vulnerabilities like CWE-917 to your infrastructure
EchelonGraph correlates every CVE — across CWE-917 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →