CVE-2019-20191
Oxygen XML Editor 21.1.1 allows XXE to read any file.
7.5 High
CVE-2019-20191 is a high vulnerability (CVSS 7.5) in Sync Oxygen Xml Editor, published March 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 66th percentile. No source names a fixed version.
Oxygen XML Editor 21.1.1 allows XXE to read any file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
1.15%Up 0.7 points since Apr 14, 2021
What each source reports
NVD Score used
Oxygen XML Editor 21.1.1 allows XXE to read any file.
- Record
CVE-2019-20191- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
Oxygen XML Editor 21.1.1 allows XXE to read any file.
- Record
CVE-2019-20191- Updated
- 2026-11-02
EUVDEUVD-2019-10745 No score
Oxygen XML Editor 21.1.1 allows XXE to read any file.
- Record
EUVD-2019-10745- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wrcc-xjp4-3f52
Oxygen XML Editor 21.1.1 allows XXE to read any file.
Oxygen XML Editor 21.1.1 allows XXE to read any file.
- Record
GHSA-wrcc-xjp4-3f52- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |