VulnerabilityDeferred

CVE-2026-11561

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc.

CRITICAL 9.8EPSS 0.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-917
Source: iletisim@usom.gov.tr

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.