CVE-2026-11561

Deferred Deferred - Pending Action

Expression Language Injection in Apinizer

Publication date: 2026-06-11

Last updated on: 2026-06-12

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-11

Last Modified

2026-06-12

Generated

2026-07-03

AI Q&A

2026-06-12

EPSS Evaluated

2026-07-01

NVD

CVE-2026-11561

EUVD

EUVD-2026-36238

Affected Vendors & Products

Vendor	Product	Version / Range
soagen_informatics_technologies_software_and_consulting_inc.	apinizer	From 2026.04.0 (inc) to 2026.04.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-917	The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Attack-Flow Graph

Compliance Impact

The vulnerability allows code injection due to improper neutralization of special elements in an expression language statement. This can lead to unauthorized access, data manipulation, or data breaches.

Such security issues can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access.

Specifically, a successful exploitation could compromise confidentiality, integrity, and availability of data, which are core principles in these regulations.

Executive Summary

This vulnerability is an expression language injection issue in Apinizer software by Soagen Informatics Technologies. It occurs because the software does not properly neutralize special elements used in expression language statements, which allows an attacker to inject malicious code.

Impact Analysis

The vulnerability allows code injection, which can lead to unauthorized actions or manipulation within the affected software. According to the CVSS score of 5.3, it has a low complexity and can be exploited remotely without privileges or user interaction, potentially leading to limited confidentiality impact.

Hi! I’m here to help you understand CVE-2026-11561. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70