CWE-91: XML Injection
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Also known as Blind XPath Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (cmc module) +1 moreSAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30,...8.1 High
- phpoffice phpspreadsheetXXE in PHPSpreadsheet due to encoding issue8.8 High
- sap knowledge management (xmlforms) in sap netweaver, netweaver +1 moreKnowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not...8.8 High
- dedecmsDedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type=...7.2 High
- dedecmsXML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized...8.8 High
- dom4j project dom4j, debian linux, netapp oncommand workflow automation +11 more +13 moreDom4j contains a XML Injection vulnerability7.5 High
- openpsa2 openpsaOpenpsa contains a XML Injection vulnerability in RSS file upload feature that can result in...7.5 High
- apache strutsApache Struts REST Plugin can potentially allow a DoS attack7.5 High
- epic mychartXPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an...7.5 High
- samlify project samlifySamlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames7.5 High
- mapsplugin googlemapsThe Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection...9.8 Critical
- netlock mokkaNetlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks...7.8 High
- microsec e-szignoMicrosec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping...7.8 High
- juniper junos, juniper networks junos os +1 moreJunos OS: Local XML Injection through CLI command can lead to privilege escalation7.0 High
- bestweblayout portfolio, bestwebsoft captcha, car rental +51 more +53 moreCross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version...6.1 Medium
- apache ambariIn Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may...7.5 High
- onelogin ruby-samlRuby-saml allows attackers to perform XML signature wrapping attacks7.5 High
- ibm bigfix remote controlIBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks...5.3 Medium
- apache solrXML Injection in Apache Solr6.4 Medium
- restletRestlet is vulnerable to Arbitrary Java Code Execution via crafted XML7.5 High
- mozilla firefox, seamonkey, thunderbird +2 more +4 moreMozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18,...7.5 High