CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- fhir hapi fhirHAPI FHIR XML External Entity (XXE) vulnerability9.8 Critical
- ibm websphere application serverIBM WebSphere Application Server XML external entity injection5.5 Medium
- openimajAn XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to...9.8 Critical
- royal-elementor-addons royal elementor addonsWordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability6.5 Medium
- microfocus application automation toolsInsecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools5.1 Medium
- microfocus application automation toolsMultiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools5.9 Medium
- microfocus application automation toolsMultiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools5.9 Medium
- ibm websphere application serverIBM WebSphere Application Server XML external entity injection5.5 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...8.8 High
- schweizerische steuerkonferenz library taxstatement.jarXML Eternal Entity Attack in the Software Library taxstatement.jar6.3 Medium
- apache xml graphics fop, formatting objects processor +1 moreApache XML Graphics FOP: XML External Entity (XXE) Processing7.5 High
- dell appsync, emc appsync +1 moreDell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection...2.9 Low
- phpoffice phpspreadsheetXML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader7.5 High
- topquadrant topbraid edgTopQuadrant TopBraid EDG JavaScript console XXE5.0 Medium
- dataeaseDataEase has an XXE vulnerability7.5 High
- gematik app-referencevalidator, reference validator +1 moreXML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator8.6 High
kimai/kimaiPackagistKimai has an XXE Leading to Local File Read8.5 High- sfs winsure, sfs consulting ww.winsure, wwwinsure +2 moreXML Injection in SFS Consulting's ww.Winsure9.2 Critical
- ivanti epm, endpoint manager +1 moreAn External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before...8.2 High
- loftware spectrumLoftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.8.8 High
- hapifhir org.hl7.fhir.core`org.hl7.fhir.core` XXE vulnerability in XSLT transforms8.6 High
- libexpat project libexpat, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +4 more +6 moreAn issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length...7.5 High
- phpoffice phpspreadsheetXML External Entity Reference (XXE) in PHPSpreadsheet8.8 High
- terminalfour, terminalfour xml jdbc +1 moreXML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC...8.8 High
- ivanti avalancheXXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to...8.2 High
- journyx, journyx (jtime) +1 moreJournyx Unauthenticated XML External Entities Injection7.5 High
- gnome libxml2, netapp h300s firmware, h410c firmware +6 more +8 moreIn libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can...9.1 Critical
- akana api platform, perforce akana api +1 moreXML External Entity in Akana6.3 Medium
- apache drillApache Drill: XXE Vulnerability in XML Format Reader8.8 High
- No product listedLaravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.4.3 Medium
- guardrailsai guardrailsXXE in Guardrails AI when consuming RAIL documents5.9 Medium
- pruvasoft informatics apinizer management consoleXML External Entity Injection in PruvaSoft Informatics' Apinizer Management Console6.5 Medium
- ibm engineering requirements management doors, engineering requirements management doors web access +1 moreIBM Engineering Requirements Management DOORS XML external entity injection7.1 High
- cyclonedx cyclonedx-core-java, core java +1 moreImproper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java7.5 High
- classgraphClassGraph XML External Entity Reference7.5 High
- kiuwan local analyzer, sast +1 moreXML External Entity Injection in Kiuwan SAST7.2 High
- adobe commerce, commerce and magento open source, commerce webhooks +1 more +3 moreXXE can expose crypt key and other secrets granting full admin access9.8 Critical
zendframework/zend-jsonPackagistZend-JSON vulnerable to XXE/XEE attacks9.8 Criticalzendframework/zendframework1PackagistZendFramework potential XML eXternal Entity injection vectors7.5 Highzendframework/zend-xmlrpcPackagistZendFramework vulnerable to XXE/XEE attacks9.8 Criticalzendframework/zendframeworkPackagistZendframework vulnerable to XXE/XEE attacks9.8 Critical- dnkorpushov ebookmeta, lxml +1 moreebookmeta XML External Entity vulnerability9.1 Critical
- dnkorpushov ebookmetaebookmeta XML External Entity vulnerability7.5 High
- ibm doors next, engineering requirements management doors next +1 moreIBM Engineering Requirements Management DOORS Next XML external entity injection8.2 High
symfony/serializerPackagistSymfony XML decoding attack vector through external entities9.8 Criticalsymfony/routingPackagistSymfony XXE security vulnerability7.5 Highsymfony/dependency-injectionPackagistSymfony XML Entity Expansion security vulnerability7.5 High- microfocus imanagerXML External Entity injection vulnerability in iManager7.8 High
- progress software telerik report server, progress telerik reporting +1 moreXML External Entity Processing Information Disclosure6.5 Medium
- microfocus imanagerXML External Entity injection vulnerability in iManager7.8 High
- Show moreLoading…