CWE-91: XML Injection
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Also known as Blind XPath Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- qcam saxy XML injection in Saxy via unescaped CDATA section terminator 2.1 Low
- qcam saxy Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection 2.1 Low
- qcam saxy XML comment injection in Saxy encoder via unescaped double hyphen 2.1 Low
- opnsense core OPNsense: XPATH Injection can disclose any secret in config.xml 7.1 High
- juniper networks junos os Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used 9.2 Critical
- adobe experience manager, experience manager 6.5 +1 more Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91) 7.1 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Path Traversal 7.2 High
- the wikimedia foundation mediawiki - easytimeline extension EasyTimeline should not serve image maps as application/xml 9.8 Critical
- zohocorp manageengine opmanager, manageengine firewall analyzer +1 more XML Injection vulnerability 7.7 High
- nvidia infrastructure controller, infra controller +1 more NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause... 5.9 Medium
- wwbn avideo WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php 5.3 Medium
- ibm webmethods integration server IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data 7.8 High
- @xmldom xmldom xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator 8.7 High
- @xmldom xmldom xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator 8.7 High
- @xmldom xmldom xmldom: Processing Instruction Target Injection Bypasses requireWellFormed 8.7 High
- @xmldom xmldom xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path 8.7 High
- @xmldom xmldom xmldom: DocType `name` Injection Bypasses requireWellFormed 8.7 High
- @xmldom xmldom xmldom: Element name injection via createElement() bypasses requireWellFormed 8.7 High
- @xmldom xmldom xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed 8.7 High
- joshnuss xml builder Element and Attribute Names Injected Verbatim into XML Output in xml_builder 2.1 Low
- joshnuss xml builder CDATA Section Breakout via Unsanitised ]]> in xml_builder 2.1 Low
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8 +3 more +5 more Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. 4.9 Medium
- qt XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization 2.9 Low
- withastro astro @astrojs/rss: XML Injection via Unescaped RSS Feed Fields 4.3 Medium
- logto-io logto Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers 8.5 High
- guzzle guzzle-services guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator 5.8 Medium
- google chrome Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote... 8.1 High
- mcdope pam usb pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries 6.5 Medium
- samlify project samlify samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions 8.7 High
- goauthentik authentik authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation 8.7 High
- naturalintelligence fast-xml-builder fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes 6.1 Medium
- naturalintelligence fast-xml-builder fast-xml-builder: Comment Value bypass regex 6.1 Medium
- traccar traccar allows XML injection in KML and GPX exports 5.4 Medium
- getkirby kirby Kirby has XML injection in its XML creator toolkit 6.9 Medium
- xmldom, red hat build of podman desktop, developer hub 1.8 +6 more +8 more xmldom: XML injection through unvalidated DocumentType serialization 8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 more xmldom: XML node injection through unvalidated processing instruction serialization 8.7 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 more xmldom: XML node injection through unvalidated comment serialization 8.7 High
- naturalintelligence fast-xml-parser fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 6.1 Medium
- xmldom, red hat migration toolkit for applications 8, build of podman desktop +6 more +8 more xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion 7.5 High
- international datacasting corporation (idc) sfx series superflex satellite receiver web management interface, datacast sfx2100 firmware +1 more XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101 5.3 Medium
- drupal central authentication system (cas) server, jtenman central authentication system server +1 more Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007 4.2 Medium
- wondershare famisafe Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path 8.5 High
- watchguard fireware, fireware os +1 more WatchGuard Firebox XPath Injection Vulnerability in Web CGI 8.2 High
- fonttools fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib 6.3 Medium
- neo4j community edition, openclinica +1 more OpenClinica Community Edition CRF Data Import ImportCRFData xml injection 5.3 Medium
- zohocorp endpoint central, manageengine endpoint central +1 more XML Injection 5.2 Medium
- ghostxbh uzy-ssm-mall An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1... 6.5 Medium
- minio minio-java minio-java Client XML Tag is Vulnerable to Value Substitution 8.7 High
- adobe experience manager Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91) 4.3 Medium
- apache hertzbeat, apache software foundation hertzbeat (incubating) +1 more Apache HertzBeat (incubating): RCE by parse http sitemap xml response 8.8 High
- Show olderLoading…