Find code injection vulnerabilities

Finds where data from an HTTP request, read through the Servlet API or bound to a Spring Web controller parameter, flows into code that is evaluated at run time: a script run by a javax.script engine or by Groovy, or an expression parsed by Spring SpEL, OGNL, MVEL, JEXL or the Jakarta Expression Language. That lets an attacker run code of their choosing. Values parsed to a number or UUID are not reported.