CWE-91: XML Injection
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Also known as Blind XPath Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- micro focus netiq access manager, microfocus access manager +1 moreDenial of service vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.15.4 Medium
- frentix openolatUnsafe Deserialization of User Data Using XStream8.8 High
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution8.2 High
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution9.1 Critical
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution9.1 Critical
- adobe commerce, magento commerce, magento open source +2 moreMagento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution9.1 Critical
- bscw classicOrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via...8.8 High
- openmage, openmage magento-lts +1 moreLayout XML Arbitrary Code Fix7.2 High
- forgerock access managementIn ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection,...9.8 Critical
- osgeo owslib, pywps, debian linux +2 moreXML External Entity Injection in PyWPS7.5 High
- att xmillA heap-based buffer overflow vulnerability exists in the XML Decompression...8.1 High
- att xmillA heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load...8.1 High
- xmldomMisinterpretation of malicious XML input in xmldom6.5 Medium
- oracle opengrokVulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior....8.8 High
- ezxml project ezxml, debian linux +1 moreAn issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_decode() performs...7.5 High
- ezxml project ezxml, debian linux +1 moreAn issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs...6.5 Medium
- ezxml project ezxml, debian linux +1 moreAn issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs...6.5 Medium
- adobe magento commerce, magento +1 moreMagento Commerce XML Injection Could Lead To Arbitrary Code Execution9.1 Critical
- adobe magento commerce, magento +1 moreMagento Commerce XML Injection Could Lead To Remote Code Execution9.1 Critical
- imagemagick, debian linux +1 moreImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which...7.8 High
- craftercms crafter cmsXML injection in Crafter CMS8.6 High
- craftercms crafter cmsXML Injection in Crafter CMS Crafter Studio 3.0.18.6 High
- petl project petlDuplicate Advisory: XML Injection in petl9.8 Critical
- ibm curam social program management, curam spm +1 moreAn XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by...5.4 Medium
- yworks yedyWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an...9.8 Critical
- sap solution manager, sap se solution manager (trace analysis) +1 moreSAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data...6.5 Medium
- sap solution manager, sap se solution manager (problem context manager) +1 moreSAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary...8.2 High
- abb advabuild, central licensing system, compact hmi +16 more +18 moreABB Central Licensing System - XML External Entity Injection9.4 Critical
- onlyoffice document serverAn issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious ...9.8 Critical
- apple icloud, icloud for windows, ios +9 more +11 moreA buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.3.1...8.8 High
- boschsecurity nbn-498 dinion2x day\/night ip cameras firmwareThe web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264...9.8 Critical
- microsoft .net framework, .net framework 3.0, .net framework 3.5 +50 more +52 moreA remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate...9.8 Critical
- mobileiron sentry, virtual smartphone platform +1 moreMobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication...9.1 Critical
- ezxml project ezxmlAn issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML...6.5 Medium
- xmlblueprintXMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is:...8.1 High
- edit-xml easy xml editorEasy XML Editor through v1.7.8 is affected by: XML External Entity Injection. The impact is:...8.1 High
- modoboa modoboa-dmarcModoboa is vulnerable to an XML External Entity Injection (XXE)7.5 High
- ibm cognos analyticsIBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack...8.3 High
- adobe systems incorporated magento 2, magento +1 moreMagento 2 Community Edition XML Injection9.8 Critical
- clipsoft rexpertClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via...8.8 High
- dlink dir-865l firmwareD-Link DIR-865L has PHP File Inclusion in the router xml file.9.8 Critical
- eclipse wild web developer, theia xml extension project xml extension, xml language server project server project +2 moreXML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML Language Support (aka...8.8 High
- reportlabXML Injection in ReportLab9.8 Critical
- sap financial consolidationDue to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1,...6.5 Medium
- ibm security directory serverIBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used...7.1 High
- nsa ghidraNSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if...9.8 Critical
- axway securetransportAxway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is...9.8 Critical
- libnmapXML Injection in python-libnmap7.5 High
- dlink dir-818lw firmwareAn issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a...8.8 High
- otrs, debian linux +1 moreAn issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0...6.5 Medium
- Show moreLoading…