CVE-2026-11561

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.

This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

VendorProductVersions
Soagen Informatics Technologies Software and Consulting Inc.Apinizer>= 2026.04.0, < 2026.04.6

References

Timeline

Published
Jun 11, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-115624.3The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticaCVE-2026-115639.6The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have CVE-2026-1156384.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka aCVE-2026-115649.1libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy CVE-2026-115658.5The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions,CVE-2026-1156574.8When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured creCVE-2026-115675.9The SureForms WordPress plugin before 2.11.1 does not properly validate the payment amount on forms that use a dynamically-sourced (variablCVE-2026-115687.5The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returnCVE-2026-115695.4A flaw was found in Quay. The filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository wriCVE-2026-11578.8A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgCVE-2026-115704.2The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured disCVE-2026-115717.5The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing