Sonatype Nexus Repository Manager prior to 3.14 allows Java Expression Language Injection.
sonatype nexus repository manager