CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.2 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- sensiolabs symfony Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true 2.3 Low
- jetbrains phpstorm In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset... 4.3 Medium
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response... 3.1 Low
- apache software foundation ofbiz Apache OFBiz: XML external entity injection (XXE) No score
- wowza streaming engine Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote... 7.5 High
- ibm mq IBM MQ Managed File Transfer is affected by a denial of service vulnerability 8.1 High
- ibm mq IBM MQ Managed File Transfer is vulnerable to XML external entity injection 7.1 High
- ibm mq IBM MQ Managed File Transfer is vulnerable to XML external entity injection 7.1 High
- tubitak bilgem software technologies research institute imzager XXE in TÜBİTAK BİLGEM's İmzager 3.3 Low
- quest foglight for databases Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability 8.2 High
- quest foglight for databases Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability 7.2 High
- mailenable MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability 6.5 Medium
- krajowa izba rozliczeniowa szafir, szafir weryfikująca +1 more XML External Entity injection in Szafir and Szafir Weryfikująca 8.2 High
- apereo foundation openequella XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read 7.1 High
- apereo foundation openequella XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion 6.1 Medium
- progress software telerik document processing libraries XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing 7.5 High
- tactis novigest desktop app Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App 8.3 High
- apache software foundation camel Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity… 7.5 High
- kitodo kitodo-production Kitodo.Production: XXE in XMLUtils EAD/XML upload parsers (parseXMLString / getNumberOfEADElements / checkIfXmlIsWellFormed lack secure JAXP config) 8.7 High
- phpoffice phpspreadsheet PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service 8.8 High
- phpoffice phpspreadsheet PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service 8.8 High
- apache software foundation abdera Apache Abdera: XML external entity expansion in Atom document parsing 8.7 High
- eclipse foundation openj9 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader) 6.8 Medium
- apache software foundation camel Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present 6.5 Medium
- apache software foundation camel Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default 8.2 High
- apache camel Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option 7.5 High
- yamaha corporation vocaloid6 editor VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity... 6.9 Medium
- sparx systems enterprise architect XML External Entity injection in Sparx Enterprise Architect 8.2 High
- ellucian webadvisor Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection 8.7 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 more ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 8.6 High
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 more Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 9.6 Critical
- commvault cloud, grid(hsx) cvfs +1 more CVFS Information Disclosure 8.7 High
- ibm tririga application platform Security Vulnerability identified in IBM TRIRIGA - XXE 7.6 High
- progress software corporation marklogic server Improper XML external entity restriction in Progress MarkLogic Server 7.1 High
- progress software corporation marklogic server Improper XML external entity restriction in Progress MarkLogic Server SAML processing 7.5 High
- eclipse foundation jaxb-ri (core) The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML... 8.3 High
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 more IBM DataPower Gateway XXE 8.2 High
- arista networks cloudvision cue Security Advisory 0190 7.1 High
- newell brands dymo id Newell Brands DYMO ID document parsing failing file type extension authentication check 5.1 Medium
- copernik-eu copernik-xml-factory Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider) 8.2 High
- apache software foundation camel quarkus Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening 8.6 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference 7.0 High
- apache software foundation roller Apache Roller: XML external entity processing in trackback response parser 7.7 High
- apache software foundation roller Apache Roller: XML external entity processing in OPML bookmark import 7.7 High
- ibm financial transaction manager (ftm) for redhat openshift FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an... 6.5 Medium
- http4s http4s-scala-xml http4s-scala-xml has an XML External Entity (XXE) processing issue 9.3 Critical
- ibm datastage on cloud pak for data DataStage on Cloud Pak for Data has several vulnerabilities 7.7 High
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 more IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities 7.4 High
- Show olderLoading…