CVE-2026-11561

Full vulnerability record from the local CVENow database.

Description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-06-11 13:16:32.017000

Last modified

2026-10-25 23:10:00.167000

View original CVE JSON

{
  "id": "CVE-2026-11561",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-11T13:16:32.017",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.\n\nThis issue affects Apinizer: from 2026.04.0 before 2026.04.6."
    },
    {
      "lang": "es",
      "value": "Neutralización incorrecta de elementos especiales utilizados en una declaración de lenguaje de expresión (’inyección de lenguaje de expresión’) vulnerabilidad en Soagen Informatics Technologies Software and Consulting Inc. Apinizer permite la inyección de código.\n\nEste problema afecta a Apinizer: desde 2026.04.0 antes de 2026.04.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Soagen Informatics Technologies Software and Consulting Inc.",
          "product": "Apinizer",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2026.04.0",
              "lessThan": "2026.04.6",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-11T13:55:57.991756Z",
          "id": "CVE-2026-11561",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-917"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365",
      "source": "[email protected]"
    }
  ]
}