CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)4.5 Medium
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)6.8 Medium
- akamai cloudtestAkamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE)...5.8 Medium
- allure-framework allure2Allure 2's xunit-xml-plugin Vulnerable to Improper XXE Restriction7.5 High
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM XML external entity injection7.1 High
- powsybl powsybl-corePowSyBl Core XML Reader allows XXE and SSRF2.7 Low
- ibm webmethods integration server, webmethods integration +1 moreIBM webMethods Integration Sever XML external entity injection8.8 High
org.geonetwork-opensource:gn-web-appMaven,org.geonetwork-opensource:gn-wfsfeature-harvesterMaven +1 moreGeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint8.2 High- geoserver, geotools, osgeo geonetwork +2 moreGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling9.9 Critical
- geoserverGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)9.3 Critical
- No product listedKeyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can...7.5 High
org.geotools:gt-wfs-ngMaven,org.geotools:gt-xsd-coreMaven +1 moreGeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling9.9 Critical- pixelgrade category iconWordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability9.1 Critical
- fengoffice feng officeFengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference5.3 Medium
- phpoffice mathPHPOffice Math allows XXE when processing an XML file in the MathML format8.7 High
- lantronix device installerLantronix Device Installer Improper Restriction of XML External Entity Reference6.9 Medium
- eclipse jgitXXE vulnerability in Eclipse JGit6.8 Medium
- hitachi jp1/it desktop management 2 - smart device managerXXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager8.7 High
- bonigarcia webdrivermanagerXML External Entity (XXE) injection vulnerability in WebDriverManager9.3 Critical
- peergosImproper Restriction of XML External Entity Reference in Peergos8.8 High
- suluSulu vulnerable to XXE in SVG File upload Inspector6.1 Medium
- siemens polarion v2310, polarion v2404, polarion alm +2 moreA vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All...7.1 High
- sap supplier relationship management, sap se supplier relationship management (live auction cockpit) +1 moreMultiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)8.6 High
- sysaid, sysaid on-prem +1 moreSysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection9.3 Critical
- sysaid, sysaid on-prem +1 moreSysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection9.3 Critical
- sysaid, sysaid on-prem +1 moreSysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection9.3 Critical
- dell storage center - dell storage manager, storage manager +1 moreDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper...8.1 High
- langroidLangroid Vulnerable to XXE Injection via XMLToolMessage7.8 High
- wso2 api manager, enterprise integrator, enterprise service bus +2 more +4 moreAn XML External Entity (XXE) vulnerability in Multiple WSO2 Products9.1 Critical
- gfi mailessentialsGFI MailEssentials < 21.8 XXE Arbitrary File Read6.5 Medium
- filez clientAn improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary...5.1 Medium
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference4.9 Medium
- hitachi vantara pentaho business analytics serverHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference4.9 Medium
- teic teigarageTEIGarage XML External Entity (XXE) Injection in Document Conversion Service7.5 High
ibexa/fieldtype-richtextPackagistibexa/fieldtype-richtext allows access to external entities in XML7.1 Highezsystems/ezplatform-richtextPackagistezsystems/ezplatform-richtext allows access to external entities in XML7.1 High- nakivo backup & replication directorAn XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1...8.6 High
- supsystic easy google mapsWordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability6.6 Medium
- zhangyanbo2007 youkefuzhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference5.3 Medium
- atlassian jiraThe XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server7.7 High
- w3 css validatorThere is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to…8.4 High
- jetbrains golandIn JetBrains GoLand before 2025.1 an XXE during debugging was possible4.1 Medium
- jalios jplatformJalios JPlatform 10 Authenticated XML External Entity Injection (XXE)6.8 Medium
- No product listedcrmeb_java WeChatMessageController.java webHook xml external entity reference5.3 Medium
io.github.robothy:local-s3-restMavenLocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection6.9 Mediumio.github.robothy:local-s3-restMavenLocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API6.9 Mediumio.github.robothy:local-s3-restMavenLocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection6.9 Medium- robothy local-s3LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection5.5 Medium
- ibm aspera sharesIBM Aspera Shares XML external entity injection7.1 High
- luceeRCE in Lucee REST endpoint9.8 Critical
- Show moreLoading…