CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- eyoucmsXML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial...7.5 High
- mustangproject mustangMustangproject allows exfiltrating files via XXE attacks2.8 Low
- iteras peppol-pyPeppol-py is vulnerable to XXE attacks due to Saxon configuration5.0 Medium
- kivitendoKivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD...5.0 Medium
- geoserverGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature8.2 High
- cnblogs pdfpatcherPDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML...7.1 High
- bestfeng oa git freebestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference5.3 Medium
- n-able n-centralN-central Multiple XXE Injection Vulnerabilities8.4 High
- cyclonedx cyclonedx-core-javaCycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection7.5 High
- metinfoA Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity ...7.5 High
- wso2 api control plane, api manager, enterprise integrator +7 more +9 moreXML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration6.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability7.1 High
- jenkins jdepend, jenkins project jdepend plugin +1 moreJenkins JDepend Plugin vulnerable to XML external entity attacks7.1 High
- apache tika, apache software foundation tika core, tika parsers +1 more +3 moreApache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected8.4 High
- dell storage managerDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper...6.5 Medium
- langchain-ai langchain-ai/langchainXXE Vulnerability in langchain-ai/langchain7.5 High
- jinher oaJinher OA type xml external entity reference6.9 Medium
- splunk, splunk cloud platform, enterprise +2 moreExtensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise4.6 Medium
- saison dataspider servistaImproper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and...8.8 High
- bjskzy zhiyou erpBjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity reference6.9 Medium
- jinher oaJinher OA text xml external entity reference5.3 Medium
- jinher oaJinher OA XML text xml external entity reference6.9 Medium
- teccom tecconnectXML External Entity Injection in TecConnect 4.19.1 Critical
- jinher oaJinher OA XML Type xml external entity reference6.9 Medium
- jinher oaJinher OA XML Type xml external entity reference6.9 Medium
- langchain-ai langchain-ai/langchainSensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain7.5 High
- sangfor technologies co. ltd. behavior management system (dc management system)Sangfor Behavior Management System XML External Entity Injection8.7 High
- agiloftAgiloft XML external entity local path traversal5.1 Medium
- delta electronics eip builderEIP Builder XML External Entity Processing Information Disclosure Vulnerability5.5 Medium
- apache tika, apache software foundation tika pdf parser module +1 moreApache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA8.4 High
- lexmark printer software g2, universal print driver +1 moreXML External Entity Injection vulnerability in various Lexmark Universal Drivers8.2 High
- dell cloudlinkDell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External...5.5 Medium
- siemens simotion scout tia v5.4, simotion scout tia v5.5, simotion scout tia v5.6 +8 more +10 moreA vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA...6.8 Medium
- telstra open-kildaOpenKilda XXE in SAML configuration6.9 Medium
- xerox freeflow coreXXE leading to SSRF7.5 High
- adobe experience manager, experience manager forms +1 moreAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)8.6 High
- dell smartfabric os10 software, smartfabric os10 +1 moreDell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of...6.5 Medium
- solarwinds web help deskSolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability5.3 Medium
- samsung magicinfo 9 serverImproper Restriction of XML External Entity Reference vulnerability in Samsung Electronics...8.2 High
- lantronix provisioning managerLantronix Provisioning Manager Improper Restriction of XML External Entity Reference8.6 High
- etq reliance cg (legacy)ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler6.9 Medium
- dell appsyncDell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity...4.2 Medium
- jinher oaJinher OA XmlHttp.aspx xml external entity reference6.9 Medium
- jinher oaJinher OA ProjectScheduleDelete.aspx xml external entity reference6.9 Medium
- No product listedagorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML...6.5 Medium
- dspaceDSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources6.9 Medium
- apache jackrabbitApache Jackrabbit: XXE vulnerability in jackrabbit-spi-commons8.8 High
- jinher oaJinher OA DelTemp.aspx xml external entity reference6.9 Medium
- schneider electric ecostruxure™ it data center expertCWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could...5.9 Medium
- adobe coldfusionColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)9.3 Critical
- Show moreLoading…