CWE-91: XML Injection
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Also known as Blind XPath Injection.
A kind of CWE-74 Injection.
From the CWE List. © The MITRE Corporation.
Newest
- xmltodictxmltodict 0.14.2 - XML Injection6.9 Medium
- No product listedAn XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 7...5.3 Medium
- adobe coldfusionColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)7.4 High
- No product listedAn XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java...8.1 High
- ibm voice gatewayIBM ICP - Voice Gateway XML injection8.1 High
- zerowdd myblogZeroWdd myblog BlogMapper.xml xml injection5.3 Medium
- hewlett packard enterprise (hpe) hpe insight remote support, hpe insight remote support +1 moreAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow...7.3 High
- hewlett packard enterprise (hpe) hpe insight remote support, hpe insight remote support +1 moreAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow...7.3 High
- hewlett packard enterprise (hpe) hpe insight remote support, hpe insight remote support +1 moreAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow...7.3 High
- openimajAn XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to...9.8 Critical
- sap bex web java runtime export web serviceXML injection in SAP BEx Web Java Runtime Export Web Service8.2 High
- google androidIn attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible...7.8 High
- moderncampus omni cmsXPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1...5.3 Medium
robrichards/xmlseclibsPackagistrobrichards/xmlseclibs XPath injection7.5 High- logpoint siemAn issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while...5.3 Medium
- unified automation uagatewayUnified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability5.8 Medium
- parallels desktopParallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability7.8 High
- verapdf verapdf-libraryPotential XSLT injection vulnerability when using policy files8.1 High
- netentsec application security gateway, ns-asg application security gateway +1 moreNetentsec NS-ASG Application Security Gateway naccheck.php xpath injection4.3 Medium
- netentsec application security gateway, ns-asg application security gateway +1 moreNetentsec NS-ASG Application Security Gateway resetpwd.php xpath injection4.3 Medium
- firebear studio improved import and export, firebearstudio improved import \& export +1 moreA XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved...7.2 High
- splunk, splunk enterprise, cloud +2 moreRemote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing8.0 High
- ibm security directory server, security directory suite, security verify directory +2 moreIBM Security Directory Server external entity injection5.5 Medium
- nodebbA remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum...9.8 Critical
- codehaus-plexus plexus-utils, red hat a-mq clients 2, a-mq online +28 more +30 moreCodehaus-plexus: xml external entity (xxe) injection4.3 Medium
- reportlab, debian linux +1 moreReportLab vulnerable to remote code execution via paraparser9.8 Critical
- opennms horizon, meridian +1 moreAuthenticated XXE Injection Via The File Editor5.3 Medium
- apache ivyApache Ivy: XML External Entity vulnerability in Apache Ivy8.2 High
- adobe commerceAdobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read7.5 High
- adobe commerce, magento, magento commerce +2 moreAdobe Commerce XML Injection Security feature bypass6.5 Medium
- umbraco cmsUmbraco CMS 7.12.4 allows Remote Code Execution by authenticated administrators via msxsl:script...7.2 High
- adobe commerce, magento commerce, magento open source +2 moreAdobe Commerce XML Injection Arbitrary file system read7.5 High
- netgate pfsenseA command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0...8.8 High
- github cmark-gfmcmark-gfm out-of-bounds read in validate_protocol5.3 Medium
- ivanti endpoint managerXML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to...7.8 High
- intel quartus primeXML injection in the Intel(R) Quartus Prime Pro and Standard edition software may allow an...6.5 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: Unauthenticated XPath Injection vulnerability in J-Web5.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: XPath Injection vulnerability in J-Web4.3 Medium
- adobe commerce, magento commerce, magento +2 moreAdobe Commerce XML Injection Arbitrary code execution9.1 Critical
- redhat process automation managerXML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with...8.2 High
- broadcom ca clarityCA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could...7.5 High
- zoom meetings, zoom video communications inc client for meetings for android, client for meetings for ios +3 more +5 moreImproper XML Parsing in Zoom Client for Meetings8.1 High
- hcl software unicaHCL Unica Platform is vulnerable to XML External Entity (XXE) injection7.5 High
- cisco firepower threat defense software, secure firewall threat defense +1 moreCisco Firepower Threat Defense Software XML Injection Vulnerability4.4 Medium
nokogiriRubyGemsXML Injection in Xerces Java affects Nokogiri6.5 Medium- altn securitygatewayALIN MDaemon Security Gateway through 8.5.0 allows XML Injection.5.3 Medium
- overit geocallAn issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test...8.8 High
- apache software foundation xerces, apache xerces-j, netapp active iq unified manager +27 more +29 moreInfinite loop within Apache XercesJ xml parser6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIt was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox....10.0 Critical
- ibm infosphere information serverIBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE)...7.1 High
- Show moreLoading…