CVE-2026-11561

CriticalCVSS 9.8/10Last modified Oct 25, 2026

Description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.

This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-917

Affected software

Vendor	Product	Versions
Soagen Informatics Technologies Software and Consulting Inc.	Apinizer	>= 2026.04.0, < 2026.04.6

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365

Timeline

Published: Jun 11, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1156106.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publ CVE-2026-1156117.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filte CVE-2026-1156127.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stor CVE-2026-1156136.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create CVE-2026-1156145.3Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiti CVE-2026-115624.3The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authentica CVE-2026-1156246.9GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi CVE-2026-1156276.0Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only t CVE-2026-115639.6The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have CVE-2026-1156356.0Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. W CVE-2026-1156384.3OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a CVE-2026-115649.1libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy