# CWE-112.

Every Advisory and CVE whose sources give the weakness CWE-112, newest first.

## Records, newest first

- [Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods](https://agentprime.io/advisories/GHSA-63v5-26vq-m4vm.md)
  `GHSA-63v5-26vq-m4vm`, `CVE-2026-1190` · Maven `org.keycloak:keycloak-services`: affected `<=26.5.2`, no fixed version yet · CVSS 3.1 Low · Not analysed yet · Published 26 Jan 2026 · Tags: Weak cryptography or TLS, Authentication bypass, CWE-112
- [Apache Struts 2 is Missing XML Validation](https://agentprime.io/advisories/GHSA-qcfc-hmrc-59x7.md)
  `GHSA-qcfc-hmrc-59x7`, `CVE-2025-68493` · Maven `com.opensymphony:xwork` and 2 more: affected `>=2.0.0`, no fixed version yet · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 11 Jan 2026 · Tags: XML external entities (XXE), CWE-112
- [Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import](https://agentprime.io/advisories/CVE-2023-40310.md)
  `CVE-2023-40310` · CVE record: SAP_SE SAP PowerDesigner Client · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-112
- [HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction](https://agentprime.io/advisories/CVE-2021-27780.md)
  `CVE-2021-27780` · CVE record: HCL Software HCL BigFix Mobile / Modern Client Management · CVSS 5.3 Medium · Not analysed yet · Published 27 May 2022 · Tags: CWE-112
- [Missing XML Validation in Apache Tomcat](https://agentprime.io/advisories/GHSA-prc3-7f44-w48j.md)
  `GHSA-prc3-7f44-w48j`, `CVE-2014-0119` · Maven `org.apache.tomcat:tomcat` and 2 more: affected `<6.0.40 || >=7.0.0, <7.0.54 || >=8.0.0, <8.0.6`, fixed in `6.0.40`, `7.0.54`, `8.0.6` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: CWE-112
- [Missing XML Validation in Apache CXF](https://agentprime.io/advisories/GHSA-254q-rp36-v2m8.md)
  `GHSA-254q-rp36-v2m8`, `CVE-2013-2160` · Maven `org.apache.cxf:cxf-rt-frontend-jaxrs`: affected `>=2.5.0, <2.5.10 || >=2.6.0, <2.6.7 || >=2.7.0, <2.7.4`, fixed in `2.5.10`, `2.6.7`, `2.7.4` · No CVSS score · EPSS 0.32 · Not analysed yet · Published 13 May 2022 · Tags: CWE-112
- [Missing XML Validation in Spring Framework](https://agentprime.io/advisories/GHSA-vp63-rrcm-9mph.md)
  `GHSA-vp63-rrcm-9mph`, `CVE-2013-7315` · Maven `org.springframework:spring-oxm`: affected `<3.2.4.RELEASE`, fixed in `3.2.4.RELEASE` · No CVSS score · Not analysed yet · Published 13 May 2022 · Tags: CWE-112
- [Missing XML Validation in Apache Xerces2](https://agentprime.io/advisories/GHSA-7j4h-8wpf-rqfh.md)
  `GHSA-7j4h-8wpf-rqfh`, `CVE-2013-4002` · Maven `xerces:xercesImpl`: affected `<2.12.0`, fixed in `2.12.0` · No CVSS score · EPSS 0.25 · Not analysed yet · Published 13 May 2022 · Tags: CWE-112
- [SAP SE SAP BusinessObjects Business Intelligence Platform: When a user access SOAP Web services in SAP BusinessObjects Business Intelligence…](https://agentprime.io/advisories/CVE-2022-28213.md)
  `CVE-2022-28213` · CVE record: SAP SE SAP BusinessObjects Business Intelligence Platform · No CVSS score · EPSS 0.12 · Not analysed yet · Published 12 Apr 2022 · Tags: CWE-112
- [Cisco Web Security Appliance Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2021-1359.md)
  `CVE-2021-1359` · CVE record: Cisco Cisco Web Security Appliance (WSA) · CVSS 6.3 Medium · Not analysed yet · Published 8 Jul 2021 · Tags: CWE-112
- [In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently un…](https://agentprime.io/advisories/CVE-2020-27282.md)
  `CVE-2020-27282` · CVE record: Hamilton Medical AG, T1-Ventillator · No CVSS score · Not analysed yet · Published 15 Mar 2021 · Tags: CWE-112
- [Missing XML Validation in PAN-OS Web Interface](https://agentprime.io/advisories/CVE-2020-1975.md)
  `CVE-2020-1975` · CVE record: Palo Alto Networks PAN-OS · CVSS 6.8 Medium · Not analysed yet · Published 12 Feb 2020 · Tags: CWE-112

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-112>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-112/>. Everything for agents: <https://agentprime.io/llms.txt>.