CWE-917 · Command and Code Injection
Improper Neutralization of Special Elements used in an Expression Language Statement
187CVEs
6exploited
4with a public check
5likely (EPSS 10%+)
SortMost likely exploited
187 CVEs with CWE-917 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-26134In CISA KEVExploitedConfluence - Remote Code ExecutionAtlassian · Confluence Data Center · CVSS 9.8 · 2022-06-03 | 9.8 | 100% | 2022-06-03 |
| CVE-2021-26084In CISA KEVExploitedConfluence Server - Remote Code ExecutionAtlassian · Confluence Server · CVSS 9.8 · 2021-08-30 | 9.8 | 100% | 2021-08-30 |
| CVE-2021-45046In CISA KEVExploitedApache Log4j2 - Remote Code InjectionApache Software Foundation · Apache Log4j · CVSS 9 · 2021-12-14 | 9.0 | 100% | 2021-12-14 |
| CVE-2020-10199In CISA KEVExploitedSonatype Nexus Repository Manager 3 - Remote Code ExecutionSonatype · Nexus Repository · CVSS 8.8 · 2020-04-01 | 8.8 | 99% | 2020-04-01 |
| CVE-2020-17530In CISA KEVExploitedApache Struts 2.0.0-2.5.25 - Remote Code ExecutionApache Software Foundation · Apache Struts · CVSS 9.8 · 2020-12-11 | 9.8 | 96% | 2020-12-11 |
| CVE-2010-1871In CISA KEVExploitedJBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressi…Red Hat · JBoss Seam 2 · CVSS 8.8 · 2010-08-04 | 8.8 | 83% | 2010-08-04 |
| CVE-2021-31805CheckApache Struts2 S2-062 - Remote Code ExecutionApache Software Foundation · Apache Struts · 2022-04-12 | – | 85% | 2022-04-12 |
| CVE-2019-9041CheckZZZCMS 1.6.1 - Remote Code ExecutionZzzcms · Zzzphp · 2019-02-23 | – | 31% | 2019-02-23 |
| CVE-2019-16469CheckAdobe Experience Manager - Expression Language InjectionAdobe · Adobe Experience Manager · 2020-01-15 | – | 17% | 2020-01-15 |
| CVE-2025-41243CheckSpring Cloud Gateway Server Webflux - Broken Access ControlSpring · Cloud Gateway · CVSS 10 · 2025-09-16 | 10.0 | 3.7% | 2025-09-16 |
| CVE-2019-5355A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.Hp · HPE Intelligent Management Center (IMC) PLAT · 2019-06-05 | – | 54% | 2019-06-05 |
| CVE-2020-3956VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection v…Vmware · VMware Cloud Director · 2020-05-20 | – | 21% | 2020-05-20 |
| CVE-2020-7799An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> T…Fusionauth · Fusionauth · 2020-01-28 | – | 20% | 2020-01-28 |
| CVE-2018-12533JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring i…Redhat · Richfaces · 2018-06-18 | – | 19% | 2018-06-18 |
| CVE-2022-22980A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter plac…Vmware · Spring Data MongoDB · 2022-06-22 | – | 18% | 2022-06-22 |
| CVE-2019-5387A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.Hp · HPE Intelligent Management Center (IMC) PLAT · 2019-06-05 | – | 8.1% | 2019-06-05 |
| CVE-2019-5358A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.Hp · HPE Intelligent Management Center (IMC) PLAT · 2019-06-05 | – | 8.1% | 2019-06-05 |
| CVE-2019-5352A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.Hp · HPE Intelligent Management Center (IMC) PLAT · 2019-06-05 | – | 8.1% | 2019-06-05 |
| CVE-2019-11949A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.Hp · HPE Intelligent Management Center (IMC) PLAT · 2019-06-05 | – | 8.1% | 2019-06-05 |
| CVE-2020-7170A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7169A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7168A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7166A operatorgrouptreeselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to i…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7165A iccselectcommand expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7164A operationselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7163A navigationto expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7162A operatorgroupselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC P…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7161A reporttaskselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7160A iccselectdeviceseries expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7158A perfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E07…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7157A selviewnavcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7156A faultinfo_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7155A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7153A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7152A faultparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E070…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7151A faulttrapgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7148A deployselectsoftware expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7147A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7145A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E07…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7141A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-24652A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-24651A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 7.0% | 2020-10-19 |
| CVE-2020-7172A templateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E07…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7171A guidatadetail expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E070…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7167A quicktemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7159A customtemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7154A ifviewselectpage expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7150A faultstatchoosefaulttype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLA…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7149A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
| CVE-2020-7146A devgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E07…Hp · HPE Intelligent Management Center (iMC) · 2020-10-19 | – | 6.9% | 2020-10-19 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.