SecuriTricks - CVE-2026-11561

Description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

Product(s) Impacted

Vendor	Product	Versions
Soagen Informatics Technologies Software And Consulting Inc	Apinizer	2026.04.0-2026.04.6

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	soagen_informatics_technologies_software_and_consulting_inc	apinizer	2026.04.0-2026.04.6	/	/	/	/	/	/	/

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365

CVSS Score

5.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View Vector String

Timeline

Published: June 11, 2026, 1:16 p.m.
Last Modified: June 11, 2026, 3:28 p.m.

Status : Deferred

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-11561