CVE-2025-3322CWE-917

Improper Neutralization of Special Elements in OnlineSuite

Critical · published June 6, 2025

CVSS v4.0
10.0
EPSS
1%
Percentile
50.4
In the wild
Unconfirmed
What it is

An improper neutralization of inputs used in expression

language allows remote code execution with the highest privileges on the

server.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00647 · 50.4th percentile
Weakness
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Published
2025-06-06T08:13Z
EPSS history
Timeline
  • 06 JUN 08:13Z
    Improper Neutralization of Special Elements in OnlineSuite
    cvelistv5