CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- jenkins project ivy report pluginJenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML...7.1 High
- ibm qradar, qradar security information and event manager +1 moreIBM QRadar SIEM has an XML External Entity (XXE) injection vulnerability8.2 High
- eclipse accessibility tools framework, eclipse foundation accessibility tools framework (actf), soumu michecker +2 moreIn Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code...4.6 Medium
- ibm datapower gateway 10.5.0, datapower gateway 10.6.0, datapower gateway 10.6cd +2 moreIBM DataPower Gateway affected by XML external entity injection5.5 Medium
- gladinet centrestackCentreStack < 17.4 XXE via SharePoint Storage Configuration8.7 High
- verapdf verapdf-validationveraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs6.5 Medium
- verapdf verapdf-validationveraPDF Validation XXE via Rich Text8.7 High
- verapdf verapdf-validationveraPDF Validation XXE via XFA8.7 High
- No product listedJinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web...7.5 High
- asseco procertum smartsignImproper Restriction of XML External Entity Reference in proCertum SmartSign4.8 Medium
- netcad software inc. netgisXXE in Netcad's NetGIS7.5 High
- proxmox libpve-storage-perllibpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML...9.8 Critical
- adobe experience manager, experience manager 6.5, experience manager 6.5 lts +1 more +3 moreAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)9.6 Critical
- dell unisphere for powermaxDell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of...5.3 Medium
- foxit pdf editor, pdf reader +1 moreFoxit PDF Editor/Reader XDP XFA XXE arbitrary local file read6.5 Medium
- openremote, io.openremote openremote-manager +1 moreOpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory7.6 High
- apache lucene.netApache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser4.0 Medium
- ibm business automation manager open editions, business automation manager +1 moreXXE attack in IBM Business Automation Manager Open Editions7.6 High
- red hat build of apicurio registry 3.3.1, redhat build of apicurio registry +1 moreApicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dos8.5 High
- gnome libxml2libxml2: Use after free in xmlParseInternalSubset via improper entity resolution handling7.0 High
- zhilink 智互联(深圳)科技有限公司 adp application developer platform 应用开发者平台zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference5.3 Medium
- nokogiriNokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-262472.6 Low
- mcdope pam usbpam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c6.7 Medium
- hapifhir hl7 fhir core, org.hl7.fhir.core +1 moreHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory8.7 High
- osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver:gs-main +2 moreGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution6.5 Medium
- apache cxf, red hat build of apache camel 4 for quarkus 3, build of apache camel 4.18 for quarkus 3.33 +12 more +14 moreApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils9.8 Critical
- broadcom spring web services, spring web services +1 moreJaxp13 XPath XXE via StreamSource and SAXSource8.2 High
- broadcom spring rest docs, spring rest docs +1 moreXML External Entity (XXE) injection when documenting untrusted XML content5.9 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)7.4 High
- schneider electric ecostruxure™ it data center expert, schneider-electric struxureware data center expert +1 moreCWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could...7.1 High
- docling, red hat openshift ai 3.4 +1 moreDocling: Unsafe XML Entity Expansion in USPTO Patent Backend7.5 High
- doclingDocling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend5.5 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible3.3 Low
- sensiolabs symfony, symfony dom-crawler +1 moreSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true8.7 High
- hitachi vantara pentaho data integration and analytics, hitachi vantara pentaho data integration and analytics +1 moreHitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference7.7 High
- ibm engineering lifecycle managementIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack7.1 High
- apache cxfApache CXF: XXE vulnerability in WS-Transfer functionality5.3 Medium
- typo3 extension "faceted search"XML External Entity Injection in extension "Faceted Search" (ke_search)5.9 Medium
- No product listedOinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing...6.5 Medium
- frappe erpnextERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module5.3 Medium
- anzory solidcam-gppl-ideSolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser7.1 High
- naturalintelligence fast-xml-builderfast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes6.1 Medium
org.opencms:opencms-coreMavenAlkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host7.5 Highorg.opencms:opencms-coreMavenAlkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information7.3 High- givanz vvvebVvveb < 1.0.8.2 XML External Entity Injection via Import8.6 High
- getgrav gravGrav - XML External Entity Injection via SVG Upload7.1 High
- No product listedOpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature...9.8 Critical
- dgtlmoon changedetection.io, webtechnologies changedetection +1 morechangedetection.io: XXE vulnerability in the changedetection.io project8.2 High
- apache opennlp, red hat build of apache camel for spring boot 4, data grid 8 +4 more +6 moreApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor9.1 Critical
- ilm informatique jopendocumentjOpenDocument has an improper restriction of XML external entity reference vulnerability5.3 Medium
- Show moreLoading…