CWE-611: XXE
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Also known as Improper Restriction of XML External Entity Reference.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities7.4 High
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities8.5 High
- joniles mpxjMPXJ: XXE Vulnerability in MerlinReader7.5 High
- james-heinrich getid3getID3 through 1.9.26 XML External Entity Injection via XML2array8.3 High
- cisco identity services engine software, ise passive identity connector, identity services engine +2 moreCisco ISE XML External Entity Injection Vulnerability4.9 Medium
- cisco identity services engine, identity services engine software, ise passive identity connector +1 more +3 moreCisco Identity Services Engine External Entity Injection Vulnerability4.9 Medium
- ibm mqIBM MQ Java messaging is vulnerable to XML external entity injection8.1 High
- ibm mqIBM MQ .NET client is vulnerable to XML external entity injection7.1 High
- ibm business automation workflow containers and traditionalMultiple security vulnerabilities addressed with IBM Business Automation Workflow August 20267.1 High
- flowable flowable-engineFlowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory7.1 High
- ibm business automation workflow containers and traditionalMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 20267.1 High
- ibm mqIBM MQ Managed File Transfer REST API is vulnerable to XML external entity injection6.8 Medium
- ibm mqIBM MQ Managed File Transfer is vulnerable to XML external entity injection7.1 High
- ibm mqIBM MQ Managed File Transfer is vulnerable to XML external entity injection7.1 High
- ibm mqIBM MQ Managed File Transfer is vulnerable to XML external entity injection7.1 High
- ibm business automation workflow containers and traditionalMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 20267.1 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software7.7 High
- amazon advanced jdbc wrapperImproper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin6.0 Medium
- moxi624 mogublogMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint8.7 High
- nextgen healthcare mirth connectNextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference8.7 High
- nextgen healthcare mirth connectNextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference8.8 High
- perforce akanaXML External Entity in Akana API Platform9.2 Critical
- tp-link systems inc oc200 v3, oc220 v2, tp-link systems inc. oc2000 v1 +6 more +8 moreOmada Controller XML External Entity (XXE) Injection in SAML IdP Metadata Parsing Leading to Arbitrary Local File Read6.9 Medium
- openstack horizon, the opennms group meridian +1 moreOpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host5.9 Medium
- cyberelf nanoxmlXML External Entity (XXE) Injection in CyberELF NanoXML5.3 Medium
- hitachi cosminexus component containerXXE Vulnerability in Cosminexus Component Container7.4 High
- sap se integration suiteXML External Entity (XXE) Vulnerability in SAP Integration Suite8.5 High
- No product listedAn XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1...7.5 High
- ibm app connect enterprise, integration bus for z/os, integration bus for z\/os +2 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs5.3 Medium
- ibm app connect enterprise, integration bus for z/os, integration bus for z\/os +2 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs5.3 Medium
- ibm app connect enterprise, integration bus for z/os, integration bus for z\/os +2 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs7.7 High
- exterro ftk imagerExterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing6.8 Medium
- keyence corporation lj series terminal-software, wi series terminal-software, xg visionterminal +1 more +3 moreXG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML...6.7 Medium
- red hat build of apache camel 3.33.3.sp1, build of apache camel 4 for quarkus 3, build of apicurio registry 3 +14 more +16 moreResteasy-core: resteasy sourceprovider remote unauthenticated file read7.5 High
- yacy search serverYaCy Search Server through 1.941 XML External Entity Injection via Parsers8.7 High
- mapfish mapfish-print, org.mapfish.print.print-lib, org.mapfish.print.print-servlet +2 moremapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types8.6 High
- pkp pkp-libpkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference5.1 Medium
- cisco broadworks, broadworks application delivery platform, broadworks application server +2 more +4 moreA vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an...7.5 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML...6.5 Medium
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML...6.5 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers5.5 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE5.5 Medium
- datavane tisDatavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint8.3 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty6.5 Medium
- eclipse foundation rdf4jIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE)...8.7 High
- ministry of justice uyap document editorXXE in Ministry of Justice's UYAP Document Editor6.3 Medium
- freecadFreeCAD: XXE file read and SSRF via external entity injection in Document.xml SAX parser6.1 Medium
- sap se businessobjects business intelligenceXML External Entity Injection in SAP BusinessObjects Business Intelligence6.5 Medium
- jaspersoft jasperreports serverJasperReports Server: XXE Injection Vulnerability (Unauthenticated)9.3 Critical
- apache cxfApache CXF: XXE via WSDL/XSD import parsing7.5 High
- Show moreLoading…