CWE-112: Missing XML Validation

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

A kind of CWE-1286 Improper Validation of Syntactic Correctness of Input.

From the CWE List. © The MITRE Corporation.

Newest

• red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 more Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata CVE-2026-1190 3.1 LowJanuary 26, 2026
• apache struts, red hat enterprise linux 8, fuse 7 +2 more +4 more Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component CVE-2025-68493 Public exploitFix available EPSS 50.4% 8.1 HighJanuary 11, 2026
• No product listed An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 7... CVE-2025-47184 5.3 MediumAugust 21, 2025
• sap powerdesigner, sap se powerdesigner client +1 more Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import CVE-2023-40310 6.5 MediumOctober 10, 2023
• sap netweaver, sap se netweaver (ep web page composer) +1 more Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document... CVE-2022-28217 6.5 MediumJune 13, 2022
• hcl software bigfix mobile / modern client management, hcltech bigfix mobile, modern client management +2 more HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction CVE-2021-27780 5.3 MediumMay 27, 2022
• sap businessobjects business intelligence platform When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform -... CVE-2022-28213 Public exploit EPSS 12.5% 8.1 HighApril 12, 2022
• cisco asyncos, web security appliance (wsa), web security appliance +2 more Cisco Web Security Appliance Privilege Escalation Vulnerability CVE-2021-1359 6.3 MediumJuly 8, 2021
• hamilton-medical hamilton-t1 firmware In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability... CVE-2020-27282 4.3 MediumMarch 15, 2021
• palo alto networks pan-os Missing XML Validation in PAN-OS Web Interface CVE-2020-1975 6.8 MediumFebruary 12, 2020
• apache tomcat Missing XML Validation in Apache Tomcat CVE-2014-0119 Fix available 4.3 MediumMay 31, 2014
• springsource spring framework Missing XML Validation in Spring Framework CVE-2013-7315 Fix available 6.8 MediumJanuary 13, 2014
• apache cxf Missing XML Validation in Apache CXF CVE-2013-2160 Public exploitFix available EPSS 32.3% 5.0 MediumAugust 19, 2013
• apache xerces2 java, ibm java, oracle jre +12 more +14 more Missing XML Validation in Apache Xerces2 CVE-2013-4002 Public exploitFix available EPSS 24.7% 7.1 HighJuly 23, 2013