# XML external entities (XXE). XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [XML Injection in SFS Consulting's ww.Winsure](https://agentprime.io/advisories/CVE-2024-7098.md) `CVE-2024-7098` · CVE record: SFS Consulting ww.Winsure · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Ivanti EPM](https://agentprime.io/advisories/CVE-2024-37397.md) `CVE-2024-37397` · CVE record: Ivanti EPM · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.59 · Not analysed yet · Published 12 Sept 2024 · Tags: XML external entities (XXE) - [Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.](https://agentprime.io/advisories/CVE-2023-37233.md) `CVE-2023-37233` · CVE record · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2024 · Tags: XML external entities (XXE) - [XXE vulnerability in XSLT transforms in \`org.hl7.fhir.core\`](https://agentprime.io/advisories/GHSA-6cr6-ph3p-f5rf.md) `GHSA-6cr6-ph3p-f5rf`, `CVE-2024-45294` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` and 5 more: affected `<6.3.23`, fixed in `6.3.23` · CVSS 8.6 High · Not analysed yet · Published 6 Sept 2024 · Tags: XML external entities (XXE) - [GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection](https://agentprime.io/advisories/GHSA-mcmc-c59m-pqq8.md) `GHSA-mcmc-c59m-pqq8`, `CVE-2023-26043`, `PYSEC-2023-15` · PyPI `geonode`: affected `<4.0.3`, fixed in `4.0.3` · CVSS 6.5 Medium · Not analysed yet · Published 30 Aug 2024 · Tags: XML external entities (XXE) - [XXE in PHPSpreadsheet encoding is returned](https://agentprime.io/advisories/GHSA-ghg6-32f9-2jp7.md) `GHSA-ghg6-32f9-2jp7`, `CVE-2024-45048`, `PKSA-j343-tkpg-k39h`, `PKSA-xp7t-fbrb-qjv4` · Packagist `phpoffice/phpexcel` and 1 more: affected `<=1.8.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 29 Aug 2024 · Tags: XML external entities (XXE) - [XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit malicious XML via unspecified features which cou…](https://agentprime.io/advisories/CVE-2024-22218.md) `CVE-2024-22218` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Aug 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Ivanti Avalanche](https://agentprime.io/advisories/CVE-2024-38653.md) `CVE-2024-38653` · CVE record: Ivanti Avalanche · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.92 · Not analysed yet · Published 14 Aug 2024 · Tags: XML external entities (XXE) - [Journyx Unauthenticated XML External Entities Injection](https://agentprime.io/advisories/CVE-2024-6893.md) `CVE-2024-6893` · CVE record: Journyx Journyx (jtime) · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 7 Aug 2024 · Tags: XML external entities (XXE) - [XML External Entity in Akana](https://agentprime.io/advisories/CVE-2024-3930.md) `CVE-2024-3930` · CVE record: Akana Akana API Platform · CVSS 6.3 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: XML external entities (XXE) - [XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill](https://agentprime.io/advisories/GHSA-v62g-jwj9-rfvx.md) `GHSA-v62g-jwj9-rfvx`, `CVE-2023-48362` · Maven `org.apache.drill.exec:drill-java-exec`: affected `>=1.19.0, <1.21.2`, fixed in `1.21.2` · CVSS 8.8 High · Not analysed yet · Published 24 Jul 2024 · Tags: XML external entities (XXE) - [Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.](https://agentprime.io/advisories/CVE-2024-40075.md) `CVE-2024-40075` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 22 Jul 2024 · Tags: XML external entities (XXE) - [Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-f8hx-f4xw-c646.md) `GHSA-f8hx-f4xw-c646`, `CVE-2024-6961`, `PYSEC-2026-1431` · PyPI `guardrails-ai`: affected `<0.5.0`, fixed in `0.5.0` · CVSS 5.9 Medium · Not analysed yet · Published 21 Jul 2024 · Tags: XML external entities (XXE) - [XML External Entity Injection in PruvaSoft Informatics' Apinizer Management Console](https://agentprime.io/advisories/CVE-2024-5625.md) `CVE-2024-5625` · CVE record: PruvaSoft Informatics Apinizer Management Console · CVSS 6.5 Medium · Not analysed yet · Published 18 Jul 2024 · Tags: XML external entities (XXE) - [IBM Engineering Requirements Management DOORS XML external entity injection](https://agentprime.io/advisories/CVE-2023-50304.md) `CVE-2023-50304` · CVE record: IBM Engineering Requirements Management DOORS · CVSS 7.1 High · Not analysed yet · Published 18 Jul 2024 · Tags: XML external entities (XXE) - [Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java](https://agentprime.io/advisories/GHSA-683x-4444-jxh8.md) `GHSA-683x-4444-jxh8`, `CVE-2024-38374` · Maven `org.cyclonedx:cyclonedx-core-java`: affected `>=2.1.0, <9.0.4`, fixed in `9.0.4` · CVSS 7.5 High · Not analysed yet · Published 24 Jun 2024 · Tags: XML external entities (XXE) - [ClassGraph XML External Entity Reference](https://agentprime.io/advisories/GHSA-v2xm-76pq-phcf.md) `GHSA-v2xm-76pq-phcf`, `CVE-2021-47621` · Maven `io.github.classgraph:classgraph`: affected `<4.8.112`, fixed in `4.8.112` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jun 2024 · Tags: XML external entities (XXE) - [XML External Entity Injection in Kiuwan SAST](https://agentprime.io/advisories/CVE-2023-49110.md) `CVE-2023-49110` · CVE record: Kiuwan SAST · CVSS 7.2 High · Not analysed yet · Published 20 Jun 2024 · Tags: XML external entities (XXE) - [Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability](https://agentprime.io/advisories/GHSA-m8cj-3v68-3cxj.md) `GHSA-m8cj-3v68-3cxj`, `BIT-magento-2024-34102`, `CVE-2024-34102`, `PKSA-71k8-bhfg-zj3d`, `PKSA-db8d-773v-rd1n` · Packagist `magento/community-edition`: affected `<2.4.4-p9 || >=2.4.5-p1, <2.4.5-p8 || >=2.4.6-p1, <2.4.6-p6`, fixed in `2.4.4-p9`, `2.4.5-p8`, `2.4.6-p6` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 13 Jun 2024 · Tags: XML external entities (XXE) - [Zend-JSON vulnerable to XXE/XEE attacks](https://agentprime.io/advisories/GHSA-8x2v-pcg7-94f4.md) `GHSA-8x2v-pcg7-94f4`, `PKSA-z96z-pgwj-vpjy` · Packagist `zendframework/zend-json`: affected `>=2.1.0, <2.1.6 || >=2.2.0, <2.2.6`, fixed in `2.1.6`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE), Denial of service - [Zendframework Local file disclosure via XXE injection in Zend_XmlRpc](https://agentprime.io/advisories/GHSA-229x-22xc-2f2w.md) `GHSA-229x-22xc-2f2w`, `PKSA-pyvt-9h93-zmzx` · Packagist `zendframework/zendframework1`: affected `>=1.0.0, <1.11.13`, fixed in `1.11.13` · CVSS 8.6 High · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE) - [ebookmeta XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-hx54-pf28-7xch.md) `GHSA-hx54-pf28-7xch`, `CVE-2024-37388`, `PYSEC-2026-1324` · PyPI `ebookmeta`: affected `<1.2.8`, fixed in `1.2.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE), Denial of service - [ZendFramework potential XML eXternal Entity injection vectors](https://agentprime.io/advisories/GHSA-mhpx-3rv8-wrjm.md) `GHSA-mhpx-3rv8-wrjm`, `PKSA-vxf6-mhns-kytt` · Packagist `zendframework/zendframework1`: affected `>=1.12.0, <1.12.4`, fixed in `1.12.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE), Denial of service - [ZendFramework potential XML eXternal Entity injection vectors](https://agentprime.io/advisories/GHSA-4j9x-g4x8-vcmf.md) `GHSA-4j9x-g4x8-vcmf`, `PKSA-8f4b-rwd4-yb4x` · Packagist `zendframework/zendframework1`: affected `>=1.11.0, <1.11.15 || >=1.12.0, <1.12.1`, fixed in `1.11.15`, `1.12.1` · CVSS 7.5 High · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE) - [ZendFramework vulnerable to XXE/XEE attacks](https://agentprime.io/advisories/GHSA-f4fj-q6m4-cc52.md) `GHSA-f4fj-q6m4-cc52`, `PKSA-jhzb-3sz9-q51q` · Packagist `zendframework/zend-xmlrpc`: affected `>=2.1.0, <2.1.6 || >=2.2.0, <2.2.6`, fixed in `2.1.6`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE), Denial of service - [Zendframework vulnerable to XXE/XEE attacks](https://agentprime.io/advisories/GHSA-qc7w-4567-84wv.md) `GHSA-qc7w-4567-84wv`, `PKSA-zg2n-4q1r-bfvg` · Packagist `zendframework/zendframework`: affected `>=2.1.0, <2.1.6 || >=2.2.0, <2.2.6`, fixed in `2.1.6`, `2.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE), Denial of service - [An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via ...](https://agentprime.io/advisories/GHSA-whf4-fpj8-pgg8.md) `GHSA-whf4-fpj8-pgg8`, `CVE-2024-36827`, `PYSEC-2024-76` · PyPI `ebookmeta`: affected `<1.2.8`, fixed in `1.2.8` · CVSS 7.5 High · Not analysed yet · Published 7 Jun 2024 · Tags: XML external entities (XXE) - [IBM Engineering Requirements Management DOORS Next XML external entity injection](https://agentprime.io/advisories/CVE-2023-45192.md) `CVE-2023-45192` · CVE record: IBM Engineering Requirements Management DOORS Next · CVSS 8.2 High · Not analysed yet · Published 6 Jun 2024 · Tags: XML external entities (XXE) - [Symfony XML decoding attack vector through external entities](https://agentprime.io/advisories/GHSA-j68w-pg49-f6vx.md) `GHSA-j68w-pg49-f6vx`, `PKSA-ft85-yyfg-zynf` · Packagist `symfony/serializer`: affected `>=2.0.0, <2.0.11`, fixed in `2.0.11` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2024 · Tags: XML external entities (XXE) - [Symfony XXE security vulnerability](https://agentprime.io/advisories/GHSA-rjpm-qmq7-q85w.md) `GHSA-rjpm-qmq7-q85w`, `PKSA-g1jq-pppn-wyhk` · Packagist `symfony/routing`: affected `>=2.0.0, <2.0.17`, fixed in `2.0.17` · CVSS 7.5 High · Not analysed yet · Published 30 May 2024 · Tags: XML external entities (XXE) - [Symfony XML Entity Expansion security vulnerability](https://agentprime.io/advisories/GHSA-c636-cg5r-2498.md) `GHSA-c636-cg5r-2498`, `PKSA-q1m3-5gzj-p6jw` · Packagist `symfony/dependency-injection`: affected `>=2.0.0, <2.0.17`, fixed in `2.0.17` · CVSS 7.5 High · Not analysed yet · Published 29 May 2024 · Tags: XML external entities (XXE) - [XML External Entity injection vulnerability in iManager](https://agentprime.io/advisories/CVE-2024-3969.md) `CVE-2024-3969` · CVE record: OpenText iManager · CVSS 7.8 High · Not analysed yet · Published 28 May 2024 · Tags: XML external entities (XXE) - [XML External Entity Processing Information Disclosure](https://agentprime.io/advisories/CVE-2024-4357.md) `CVE-2024-4357` · CVE record: Progress Software Telerik Report Server · CVSS 6.5 Medium · Not analysed yet · Published 15 May 2024 · Tags: XML external entities (XXE) - [XML External Entity injection vulnerability in iManager](https://agentprime.io/advisories/CVE-2024-3486.md) `CVE-2024-3486` · CVE record: OpenText iManager · CVSS 7.8 High · Not analysed yet · Published 15 May 2024 · Tags: XML external entities (XXE) - [Microsoft SharePoint Server Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-30043.md) `CVE-2024-30043` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 6.5 Medium · EPSS 0.56 · Not analysed yet · Published 14 May 2024 · Tags: XML external entities (XXE) - [@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-38gf-rh2w-gmj7.md) `GHSA-38gf-rh2w-gmj7`, `CVE-2024-34345` · npm `@cyclonedx/cyclonedx-library`: affected `>=6.7.0, <6.7.1`, fixed in `6.7.1` · CVSS 8.1 High · Not analysed yet · Published 8 May 2024 · Tags: XML external entities (XXE) - [Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-51605.md) `CVE-2023-51605` · CVE record: Honeywell Saia PG5 Controls Suite · CVSS 5.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-51604.md) `CVE-2023-51604` · CVE record: Honeywell Saia PG5 Controls Suite · CVSS 5.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-51602.md) `CVE-2023-51602` · CVE record: Honeywell Saia PG5 Controls Suite · CVSS 5.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-51601.md) `CVE-2023-51601` · CVE record: Honeywell Saia PG5 Controls Suite · CVSS 5.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-51600.md) `CVE-2023-51600` · CVE record: Honeywell Saia PG5 Controls Suite · CVSS 5.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-51591.md) `CVE-2023-51591` · CVE record: Voltronic Power ViewPower Pro · CVSS 6.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-44412.md) `CVE-2023-44412` · CVE record: D-Link D-View · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-42035.md) `CVE-2023-42035` · CVE record: Visualware MyConnection Server · CVSS 6.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-40507.md) `CVE-2023-40507` · CVE record: LG Simple Editor · CVSS 7.5 High · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-40506.md) `CVE-2023-40506` · CVE record: LG Simple Editor · CVSS 7.5 High · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-40503.md) `CVE-2023-40503` · CVE record: LG Simple Editor · CVSS 7.5 High · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [Inductive Automation Ignition SimpleXMLReader XML External Entity Processing Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-39472.md) `CVE-2023-39472` · CVE record: Inductive Automation Ignition · CVSS 6.5 Medium · Not analysed yet · Published 3 May 2024 · Tags: XML external entities (XXE) - [XML external entity injection in SonicWall GMS](https://agentprime.io/advisories/CVE-2024-29010.md) `CVE-2024-29010` · CVE record: SonicWall GMS · CVSS 7.1 High · Not analysed yet · Published 1 May 2024 · Tags: XML external entities (XXE) - [IBM WebSphere Application Server XML external entity injection](https://agentprime.io/advisories/CVE-2024-22354.md) `CVE-2024-22354` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.0 High · Not analysed yet · Published 17 Apr 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Oracle Corporation BI Publisher (formerly XML Publisher)](https://agentprime.io/advisories/CVE-2024-21082.md) `CVE-2024-21082` · CVE record: Oracle Corporation BI Publisher (formerly XML Publisher) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Oracle Corporation Web Applications Desktop Integrator](https://agentprime.io/advisories/CVE-2024-21048.md) `CVE-2024-21048` · CVE record: Oracle Corporation Web Applications Desktop Integrator · CVSS 4.3 Medium · Not analysed yet · Published 16 Apr 2024 · Tags: XML external entities (XXE) - [Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE](https://agentprime.io/advisories/GHSA-rr59-h6rh-v84v.md) `GHSA-rr59-h6rh-v84v`, `CVE-2022-47894` · Maven `org.apache.zeppelin:sap`: affected `>=0.8.0, <0.11.0`, fixed in `0.11.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: XML external entities (XXE), CWE-20 - [An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8.](https://agentprime.io/advisories/CVE-2023-49234.md) `CVE-2023-49234` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 29 Mar 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Dell PowerProtect Data Manager](https://agentprime.io/advisories/CVE-2024-25971.md) `CVE-2024-25971` · CVE record: Dell PowerProtect Data Manager · CVSS 5.5 Medium · Not analysed yet · Published 28 Mar 2024 · Tags: XML external entities (XXE) - [XML external entity injection in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2024-31139.md) `CVE-2024-31139` · CVE record: JetBrains TeamCity · CVSS 5.9 Medium · Not analysed yet · Published 28 Mar 2024 · Tags: XML external entities (XXE) - [lakernote EasyAdmin saveReportFile xml external entity reference](https://agentprime.io/advisories/CVE-2024-2826.md) `CVE-2024-2826` · CVE record: lakernote EasyAdmin · CVSS 6.3 Medium · Not analysed yet · Published 22 Mar 2024 · Tags: XML external entities (XXE) - [XML external entity injection in unclebob FitNesse](https://agentprime.io/advisories/CVE-2024-28039.md) `CVE-2024-28039` · CVE record: unclebob FitNesse · CVSS 5.8 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: XML external entities (XXE) - [IBM Maximo Application Suite XML external entity injection](https://agentprime.io/advisories/CVE-2024-27266.md) `CVE-2024-27266` · CVE record: IBM Maximo Asset Management · CVSS 8.2 High · Not analysed yet · Published 14 Mar 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Pegasystems Pega Platform](https://agentprime.io/advisories/CVE-2023-50168.md) `CVE-2023-50168` · CVE record: Pegasystems Pega Platform · CVSS 7.7 High · Not analysed yet · Published 14 Mar 2024 · Tags: XML external entities (XXE) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .