CVE-2020-3956

The record

VMware Cloud Director 10.0.x before 10.0.0.2, 9.7.0.x before 9.7.0.5, 9.5.0.x before 9.5.0.6, and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs, the API Explorer interface and API access.

Affected packages

Related vulnerabilities

• CVE-2026-65591 n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's… CWE-917
• CVE-2026-57281 Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST… CWE-917
• CVE-2026-11561 Improper neutralization of special elements used in an expression language statement… CWE-917
• CVE-2026-40985 Applications that configure the WebFlowELExpressionParser are vulnerable to the use of… CWE-917
• CVE-2026-41729 Spring Data REST is vulnerable to SpEL expression injection through map-typed properties… CWE-917
• CVE-2026-41719 A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user… CWE-917
• CVE-2026-41717 Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection… CWE-917
• CVE-2026-8888 Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and… CWE-917