CVE-2026-11561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-11561", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-06-08T07:41:39.025Z", "datePublished": "2026-06-11T12:28:27.520Z", "dateUpdated": "2026-06-12T08:38:05.509Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-12T08:38:05.509Z"}, "title": "SSTI in Soagen Informatics' Apinizer", "datePublic": "2026-06-11T12:10:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-917", "description": "CWE-917 Improper neutralization of special elements used in an expression language statement ('expression language injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "Soagen Informatics Technologies Software and Consulting Inc.", "product": "Apinizer", "versions": [{"status": "affected", "version": "2026.04.0", "lessThan": "2026.04.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.\n\nThis issue affects Apinizer: from 2026.04.0 before 2026.04.6.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.<p>This issue affects Apinizer: from 2026.04.0 before 2026.04.6.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Alperen KESK\u0130N", "type": "finder"}], "source": {"defect": ["TR-26-0365"], "advisory": "TR-26-0365", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-11T13:55:57.991756Z", "id": "CVE-2026-11561", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:56:29.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-11561", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T13:55:57.991756Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-11T13:56:02.788Z"}}], "cna": {"title": "SSTI in Soagen Informatics' Apinizer", "source": {"defect": ["TR-26-0365"], "advisory": "TR-26-0365", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alperen KESK\u0130N"}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Soagen Informatics Technologies Software and Consulting Inc.", "product": "Apinizer", "versions": [{"status": "affected", "version": "2026.04.0", "lessThan": "2026.04.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-06-11T12:10:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.\n\nThis issue affects Apinizer: from 2026.04.0 before 2026.04.6.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.<p>This issue affects Apinizer: from 2026.04.0 before 2026.04.6.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-917", "description": "CWE-917 Improper neutralization of special elements used in an expression language statement ('expression language injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-06-12T08:38:05.509Z"}}}, "cveMetadata": {"cveId": "CVE-2026-11561", "state": "PUBLISHED", "dateUpdated": "2026-06-12T08:38:05.509Z", "dateReserved": "2026-06-08T07:41:39.025Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-06-11T12:28:27.520Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apinizer", "vendor": "Soagen Informatics Technologies Software and Consulting Inc.", "versions": [{"lessThan": "2026.04.6", "status": "affected", "version": "2026.04.0", "versionType": "custom"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection.\n\nThis issue affects Apinizer: from 2026.04.0 before 2026.04.6."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de elementos especiales utilizados en una declaraci\u00f3n de lenguaje de expresi\u00f3n (\u2019inyecci\u00f3n de lenguaje de expresi\u00f3n\u2019) vulnerabilidad en Soagen Informatics Technologies Software and Consulting Inc. Apinizer permite la inyecci\u00f3n de c\u00f3digo.\n\nEste problema afecta a Apinizer: desde 2026.04.0 antes de 2026.04.6."}], "id": "CVE-2026-11561", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11561", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-11T13:55:57.991756Z", "version": "2.0.3"}}]}, "published": "2026-06-11T13:16:32.017", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0365"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-917"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.04.0,2026.04.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apinizer", "source": "cna", "vendor": "Soagen Informatics Technologies Software and Consulting Inc."}, "product": "apinizer", "vendor": "soagen_informatics"}], "created": "2026-06-11T13:30:15.069965+00:00", "updated": "2026-06-12T20:18:10.764789+00:00", "vendors": ["soagen_informatics", "soagen_informatics$PRODUCT$apinizer"]}