Skip to content
BackEsc
Sign in

CWE-917 · weakness in Command and Code Injection

Improper Neutralization of Special Elements used in an Expression Language Statement

187 CVEs · 6 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
6
check available
4
likely to be exploited
5

Every one of the 187 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Confluence - Remote Code ExecutionCVE-2022-26134Atlassian · CVSS 9.8 · 100% likely

    Atlassian

  2. Confluence Server - Remote Code ExecutionCVE-2021-26084Atlassian · CVSS 9.8 · 100% likely

    AtlassianEmber Bear

  3. Apache Log4j2 - Remote Code InjectionCVE-2021-45046Apache Software Foundation · CVSS 9 · 100% likely

    Apache

  4. Sonatype Nexus Repository Manager 3 - Remote Code ExecutionCVE-2020-10199Sonatype · CVSS 8.8 · 99% likely

    Sonatype

  5. Apache Struts 2.0.0-2.5.25 - Remote Code ExecutionCVE-2020-17530Apache Software Foundation · CVSS 9.8 · 96% likely

    Apache

  6. JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressi…CVE-2010-1871Red Hat · CVSS 8.8 · 83% likely

    Red Hat

  7. Apache Struts2 S2-062 - Remote Code ExecutionCVE-2021-31805Apache Software Foundation · 85% likely

    Apache

  8. ZZZCMS 1.6.1 - Remote Code ExecutionCVE-2019-904131% likely
  9. Adobe Experience Manager - Expression Language InjectionCVE-2019-16469Adobe · 17% likely

    Adobe

  10. Spring Cloud Gateway Server Webflux - Broken Access ControlCVE-2025-41243Spring · CVSS 10 · 3.7% likely

    Spring

  11. A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.CVE-2019-5355HPE Intelligent Management Center (IMC) PLAT · 54% likely
  12. VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection v…CVE-2020-3956VMware Cloud Director · 21% likely
  13. An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> T…CVE-2020-779920% likely
  14. JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring i…CVE-2018-1253319% likely
  15. A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter plac…CVE-2022-22980Spring Data MongoDB · 18% likely
  16. A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.CVE-2019-5387HPE Intelligent Management Center (IMC) PLAT · 8.1% likely
  17. A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.CVE-2019-5358HPE Intelligent Management Center (IMC) PLAT · 8.1% likely
  18. A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.CVE-2019-5352HPE Intelligent Management Center (IMC) PLAT · 8.1% likely
  19. A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.CVE-2019-11949HPE Intelligent Management Center (IMC) PLAT · 8.1% likely
  20. A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).CVE-2020-7170HPE Intelligent Management Center (iMC) · 7.0% likely
  21. A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.…CVE-2020-7169HPE Intelligent Management Center (iMC) · 7.0% likely
  22. A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0…CVE-2020-7168HPE Intelligent Management Center (iMC) · 7.0% likely
  23. A operatorgrouptreeselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to i…CVE-2020-7166HPE Intelligent Management Center (iMC) · 7.0% likely
  24. A iccselectcommand expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E…CVE-2020-7165HPE Intelligent Management Center (iMC) · 7.0% likely
  25. A operationselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0…CVE-2020-7164HPE Intelligent Management Center (iMC) · 7.0% likely
  26. A navigationto expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705…CVE-2020-7163HPE Intelligent Management Center (iMC) · 7.0% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in