# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Jinher OA ProjectScheduleDelete.aspx xml external entity reference](https://agentprime.io/advisories/CVE-2025-7823.md)
  `CVE-2025-7823` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 19 Jul 2025 · Tags: XML external entities (XXE), CWE-610
- [agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint.](https://agentprime.io/advisories/CVE-2025-52162.md)
  `CVE-2025-52162` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: XML external entities (XXE)
- [DSpace is vulnerable to XML External Entity injection during archive imports](https://agentprime.io/advisories/GHSA-jjwr-5cfh-7xwh.md)
  `GHSA-jjwr-5cfh-7xwh`, `CVE-2025-53621` · Maven `org.dspace:dspace-api`: affected `<7.6.4 || >=8.0, <8.2 || >=9.0, <9.1`, fixed in `7.6.4`, `8.2`, `9.1` · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: XML external entities (XXE)
- [Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build](https://agentprime.io/advisories/GHSA-44c3-38h8-9fh9.md)
  `GHSA-44c3-38h8-9fh9`, `CVE-2025-53689` · Maven `org.apache.jackrabbit:jackrabbit-core` and 1 more: affected `>=2.23.0-beta, <2.23.2-beta || >=2.20.0, <2.20.17 || >=2.22.0, <2.22.1`, fixed in `2.23.2-beta`, `2.20.17`, `2.22.1` · CVSS 8.8 High · Not analysed yet · Published 14 Jul 2025 · Tags: XML external entities (XXE)
- [Jinher OA DelTemp.aspx xml external entity reference](https://agentprime.io/advisories/CVE-2025-7523.md)
  `CVE-2025-7523` · CVE record: Jinher OA · CVSS 6.9 Medium · Not analysed yet · Published 13 Jul 2025 · Tags: XML external entities (XXE), CWE-610
- [XML external entity injection in Schneider Electric EcoStruxure™ IT Data Center Expert](https://agentprime.io/advisories/CVE-2025-6438.md)
  `CVE-2025-6438` · CVE record: Schneider Electric EcoStruxure™ IT Data Center Expert · CVSS 5.9 Medium · Not analysed yet · Published 11 Jul 2025 · Tags: XML external entities (XXE)
- [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-49535.md)
  `CVE-2025-49535` · CVE record: Adobe ColdFusion · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2025 · Tags: XML external entities (XXE)
- [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-49539.md)
  `CVE-2025-49539` · CVE record: Adobe ColdFusion · CVSS 4.5 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: XML external entities (XXE)
- [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-49544.md)
  `CVE-2025-49544` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: XML external entities (XXE)
- [XML external entity injection in Akamai CloudTest](https://agentprime.io/advisories/CVE-2025-49493.md)
  `CVE-2025-49493` · CVE record: Akamai CloudTest · CVSS 5.8 Medium · Not analysed yet · Published 30 Jun 2025 · Tags: XML external entities (XXE)
- [Allure Report allows Improper XXE Restriction via DocumentBuilderFactory](https://agentprime.io/advisories/GHSA-h7qf-qmf3-85qg.md)
  `GHSA-h7qf-qmf3-85qg`, `CVE-2025-52888` · Maven `io.qameta.allure.plugins:junit-xml-plugin` and 2 more: affected `<2.34.1`, fixed in `2.34.1` · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2025 · Tags: XML external entities (XXE)
- [IBM QRadar SIEM XML external entity injection](https://agentprime.io/advisories/CVE-2025-33121.md)
  `CVE-2025-33121` · CVE record: IBM QRadar SIEM · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2025 · Tags: XML external entities (XXE)
- [PowSyBl Core XML Reader allows XXE and SSRF](https://agentprime.io/advisories/GHSA-qpj9-qcwx-8jv2.md)
  `GHSA-qpj9-qcwx-8jv2`, `CVE-2025-47293` · Maven `com.powsybl:powsybl-commons`: affected `<6.7.2`, fixed in `6.7.2` · CVSS 2.7 Low · Not analysed yet · Published 19 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [IBM webMethods Integration Sever XML external entity injection](https://agentprime.io/advisories/CVE-2025-36049.md)
  `CVE-2025-36049` · CVE record: IBM webMethods Integration Server · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2025 · Tags: XML external entities (XXE)
- [GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint](https://agentprime.io/advisories/GHSA-2p76-gc46-5fvc.md)
  `GHSA-2p76-gc46-5fvc` · Maven `org.geonetwork-opensource:gn-web-app` and 1 more: affected `>=4.4.0, <4.4.8 || >=4.2.0, <4.2.13`, fixed in `4.4.8`, `4.2.13` · CVSS 8.2 High · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [\[XBOW-025-068\] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service](https://agentprime.io/advisories/GHSA-jj54-8f66-c5pc.md)
  `GHSA-jj54-8f66-c5pc`, `CVE-2025-30220` · Maven `org.geoserver:gs-wfs` and 1 more: affected `>=2.27.0, <2.27.1 || >=2.26.0, <2.26.3 || <2.25.7`, fixed in `2.27.1`, `2.26.3`, `2.25.7` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.44 · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)](https://agentprime.io/advisories/GHSA-mc43-4fqr-c965.md)
  `GHSA-mc43-4fqr-c965`, `CVE-2024-34711` · Maven `org.geoserver.main:gs-main` and 1 more: affected `<2.25.0`, fixed in `2.25.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2025 · Tags: Information disclosure, XML external entities (XXE), Server-side request forgery (SSRF), CWE-20
- [Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE).](https://agentprime.io/advisories/CVE-2025-44044.md)
  `CVE-2025-44044` · CVE record · CVSS 7.5 High · Not analysed yet · Published 10 Jun 2025 · Tags: XML external entities (XXE)
- [GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling](https://agentprime.io/advisories/GHSA-826p-4gcg-35vw.md)
  `GHSA-826p-4gcg-35vw` · Maven `org.geotools:gt-wfs-ng` and 1 more: affected `>=33.0, <33.1 || >=32.0, <32.3 || >=29.0, <31.7 || <28.6.1`, fixed in `33.1`, `32.3`, `31.7`, `28.6.1` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2025 · Tags: XML external entities (XXE)
- [WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/CVE-2025-31039.md)
  `CVE-2025-31039` · CVE record: pixelgrade Category Icon · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2025 · Tags: XML external entities (XXE)
- [Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference](https://agentprime.io/advisories/CVE-2025-5877.md)
  `CVE-2025-5877` · CVE record: Fengoffice Feng Office · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: XML external entities (XXE), CWE-610
- [PHPOffice Math allows XXE when processing an XML file in the MathML format](https://agentprime.io/advisories/GHSA-42hm-pq2f-3r7m.md)
  `GHSA-42hm-pq2f-3r7m`, `CVE-2025-48882`, `PKSA-jw72-bn8m-h7rc` · Packagist `phpoffice/math`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 8.7 High · Not analysed yet · Published 29 May 2025 · Tags: XML external entities (XXE)
- [Lantronix Device Installer Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-4338.md)
  `CVE-2025-4338` · CVE record: Lantronix Device Installer · CVSS 6.9 Medium · Not analysed yet · Published 22 May 2025 · Tags: XML external entities (XXE)
- [Eclipse JGit XML External Entity (XXE) Vulnerability](https://agentprime.io/advisories/GHSA-vrpq-qp53-qv56.md)
  `GHSA-vrpq-qp53-qv56`, `CVE-2025-4949` · Maven `org.eclipse.jgit:org.eclipse.jgit`: affected `>=7.2.0.202503040940-r, <7.2.1.202505142326-r || >=7.1.0.202411261347-r, <7.1.1.202505221757-r || >=7.0.0.202409031743-r, <7.0.1.202505221510-r || >=6.1.0.202203080745-r, <6.10.1.202505221210-r || >=6.0.0.202110060947-m1, <6.0.0.202111291000-r || <5.13.4.202507202350-r`, fixed in `7.2.1.202505142326-r`, `7.1.1.202505221757-r`, `7.0.1.202505221510-r`, `6.10.1.202505221210-r`, `6.0.0.202111291000-r`, `5.13.4.202507202350-r` · CVSS 6.8 Medium · Not analysed yet · Published 21 May 2025 · Tags: XML external entities (XXE)
- [Sulu vulnerable to XXE in SVG File upload Inspector](https://agentprime.io/advisories/GHSA-f6rx-hf55-4255.md)
  `GHSA-f6rx-hf55-4255`, `CVE-2025-47778`, `PKSA-tptv-6vj5-qz52` · Packagist `sulu/sulu`: affected `>=2.5.21, <2.5.25 || >=2.6.5, <2.6.9 || >=3.0.0-alpha1, <3.0.0-alpha3`, fixed in `2.5.25`, `2.6.9`, `3.0.0-alpha3` · CVSS 6.1 Medium · Not analysed yet · Published 15 May 2025 · Tags: XML external entities (XXE)
- [XXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager](https://agentprime.io/advisories/CVE-2025-27523.md)
  `CVE-2025-27523` · CVE record: Hitachi JP1/IT Desktop Management 2 - Smart Device Manager · CVSS 8.7 High · Not analysed yet · Published 15 May 2025 · Tags: XML external entities (XXE)
- [BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-pwm3-776c-8q7q.md)
  `GHSA-pwm3-776c-8q7q`, `CVE-2025-4641` · Maven `io.github.bonigarcia:webdrivermanager`: affected `>=1.0.0, <6.1.0`, fixed in `6.1.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2025 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Peergos](https://agentprime.io/advisories/CVE-2025-4639.md)
  `CVE-2025-4639` · CVE record: Peergos Peergos · CVSS 8.8 High · Not analysed yet · Published 14 May 2025 · Tags: XML external entities (XXE)
- [XML external entity injection in Siemens Polarion V2310 and others](https://agentprime.io/advisories/CVE-2024-51445.md)
  `CVE-2024-51445` · CVE record: Siemens Polarion V2310 and 1 more · CVSS 7.1 High · Not analysed yet · Published 13 May 2025 · Tags: XML external entities (XXE)
- [Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)](https://agentprime.io/advisories/CVE-2025-30018.md)
  `CVE-2025-30018` · CVE record: SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit) · CVSS 8.6 High · Not analysed yet · Published 13 May 2025 · Tags: XML external entities (XXE)
- [SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection](https://agentprime.io/advisories/CVE-2025-2777.md)
  `CVE-2025-2777` · CVE record: SysAid SysAid On-Prem · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.73 · Not analysed yet · Published 7 May 2025 · Tags: XML external entities (XXE)
- [SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection](https://agentprime.io/advisories/CVE-2025-2776.md)
  `CVE-2025-2776` · CVE record: SysAid SysAid On-Prem · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.65 · Not analysed yet · Published 7 May 2025 · Tags: XML external entities (XXE)
- [SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection](https://agentprime.io/advisories/CVE-2025-2775.md)
  `CVE-2025-2775` · CVE record: SysAid SysAid On-Prem · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.43 · Not analysed yet · Published 7 May 2025 · Tags: XML external entities (XXE)
- [XML external entity injection in Dell Storage Center - Dell Storage Manager](https://agentprime.io/advisories/CVE-2025-22478.md)
  `CVE-2025-22478` · CVE record: Dell Dell Storage Center - Dell Storage Manager · CVSS 8.1 High · Not analysed yet · Published 6 May 2025 · Tags: XML external entities (XXE)
- [Langroid Allows XXE Injection via XMLToolMessage](https://agentprime.io/advisories/GHSA-pw95-88fg-3j6f.md)
  `GHSA-pw95-88fg-3j6f`, `CVE-2025-46726`, `PYSEC-2026-1532` · PyPI `langroid`: affected `<0.53.4`, fixed in `0.53.4` · CVSS 7.8 High · Not analysed yet · Published 5 May 2025 · Tags: XML external entities (XXE)
- [WSO2 API Manager XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-h94w-8qhg-3xmc.md)
  `GHSA-h94w-8qhg-3xmc`, `CVE-2025-2905` · Maven `org.wso2.am:am-distribution-parent`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2025 · Tags: XML external entities (XXE)
- [GFI MailEssentials < 21.8 XXE Arbitrary File Read](https://agentprime.io/advisories/CVE-2025-34490.md)
  `CVE-2025-34490` · CVE record: GFI MailEssentials · CVSS 6.5 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: XML external entities (XXE)
- [XML external entity injection in FileZ Client](https://agentprime.io/advisories/CVE-2025-2070.md)
  `CVE-2025-2070` · CVE record: FileZ Client · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2025 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-24911.md)
  `CVE-2025-24911` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.9 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-24910.md)
  `CVE-2025-24910` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.9 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: XML external entities (XXE)
- [TEIGarage XML External Entity (XXE) Injection in Document Conversion Service](https://agentprime.io/advisories/CVE-2025-31497.md)
  `CVE-2025-31497` · CVE record: TEIC TEIGarage · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2025 · Tags: XML external entities (XXE)
- [ibexa/fieldtype-richtext allows access to external entities in XML](https://agentprime.io/advisories/GHSA-cj3w-g42v-wcj6.md)
  `GHSA-cj3w-g42v-wcj6`, `PKSA-ypdh-7wg7-kqn2` · Packagist `ibexa/fieldtype-richtext`: affected `>=4.6.0-beta1, <4.6.19`, fixed in `4.6.19` · CVSS 4.0, no score published · Not analysed yet · Published 10 Apr 2025 · Tags: XML external entities (XXE)
- [ezsystems/ezplatform-richtext allows access to external entities in XML](https://agentprime.io/advisories/GHSA-2jqj-5qv2-xvcg.md)
  `GHSA-2jqj-5qv2-xvcg`, `PKSA-w1xb-npn9-4xm1` · Packagist `ezsystems/ezplatform-richtext`: affected `>=2.3.0-beta1, <2.3.26`, fixed in `2.3.26` · CVSS 4.0, no score published · Not analysed yet · Published 10 Apr 2025 · Tags: XML external entities (XXE)
- [XML external entity injection in NAKIVO Backup & Replication Director](https://agentprime.io/advisories/CVE-2025-32406.md)
  `CVE-2025-32406` · CVE record: NAKIVO Backup & Replication Director · CVSS 8.6 High · Not analysed yet · Published 8 Apr 2025 · Tags: XML external entities (XXE)
- [WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability](https://agentprime.io/advisories/CVE-2025-32138.md)
  `CVE-2025-32138` · CVE record: supsystic Easy Google Maps · CVSS 6.6 Medium · Not analysed yet · Published 4 Apr 2025 · Tags: XML external entities (XXE)
- [The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server](https://agentprime.io/advisories/GHSA-wc53-4255-gw3f.md)
  `GHSA-wc53-4255-gw3f`, `CVE-2025-31487` · Maven `org.xwiki.contrib.jira:jira-macro-default`: affected `>=4.2, <8.5.6`, fixed in `8.5.6` · CVSS 7.7 High · Not analysed yet · Published 4 Apr 2025 · Tags: XML external entities (XXE)
- [zhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference](https://agentprime.io/advisories/CVE-2025-3241.md)
  `CVE-2025-3241` · CVE record: zhangyanbo2007 youkefu · CVSS 5.3 Medium · Not analysed yet · Published 4 Apr 2025 · Tags: XML external entities (XXE), CWE-610
- [XML external entity injection in W3C CSS Validator](https://agentprime.io/advisories/CVE-2025-1781.md)
  `CVE-2025-1781` · CVE record: W3C CSS Validator · CVSS 8.4 High · Not analysed yet · Published 28 Mar 2025 · Tags: XML external entities (XXE)
- [XML external entity injection in JetBrains GoLand](https://agentprime.io/advisories/CVE-2025-29932.md)
  `CVE-2025-29932` · CVE record: JetBrains GoLand · CVSS 4.1 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: XML external entities (XXE)
- [Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)](https://agentprime.io/advisories/CVE-2025-25036.md)
  `CVE-2025-25036` · CVE record: Jalios JPlatform · CVSS 6.8 Medium · Not analysed yet · Published 21 Mar 2025 · Tags: XML external entities (XXE)
- [crmeb_java WeChatMessageController.java webHook xml external entity reference](https://agentprime.io/advisories/CVE-2025-2365.md)
  `CVE-2025-2365` · CVE record: crmeb_java · CVSS 5.3 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: XML external entities (XXE), CWE-610
- [LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-47qw-ccjm-9c2c.md)
  `GHSA-47qw-ccjm-9c2c` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 4.0, no score published · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API](https://agentprime.io/advisories/GHSA-v232-254c-m6p7.md)
  `GHSA-v232-254c-m6p7` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 4.0, no score published · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-2466-4485-4pxj.md)
  `GHSA-2466-4485-4pxj` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 4.0, no score published · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-g6wm-2v64-wq36.md)
  `GHSA-g6wm-2v64-wq36`, `CVE-2025-27136` · Maven `io.github.robothy:local-s3-rest`: affected `<1.21`, fixed in `1.21` · CVSS 5.5 Medium · Not analysed yet · Published 10 Mar 2025 · Tags: XML external entities (XXE)
- [IBM Aspera Shares XML external entity injection](https://agentprime.io/advisories/CVE-2025-0162.md)
  `CVE-2025-0162` · CVE record: IBM Aspera Shares · CVSS 7.1 High · Not analysed yet · Published 7 Mar 2025 · Tags: XML external entities (XXE)
- [Lucee RCE/XXE Vulnerability](https://agentprime.io/advisories/GHSA-vwjx-mmwm-pwrf.md)
  `GHSA-vwjx-mmwm-pwrf`, `CVE-2023-38693` · Maven `org.lucee:lucee`: affected `>=5.3.10.79-RC, <5.3.12.1 || >=5.4.0.65-RC, <5.4.3.2 || <=5.3.7.59 || >=5.3.8.132-RC, <5.3.8.236 || >=5.3.9.113, <5.3.9.173`, fixed in `5.3.12.1`, `5.4.3.2`, `5.3.8.236`, `5.3.9.173` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: XML external entities (XXE)
- [Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2025-24521.md)
  `CVE-2025-24521` · CVE record: Keysight Ixia Vision Product Family · CVSS 6.9 Medium · Not analysed yet · Published 5 Mar 2025 · Tags: XML external entities (XXE)
- [IBM OpenPages XML external entity injection](https://agentprime.io/advisories/CVE-2024-49781.md)
  `CVE-2024-49781` · CVE record: IBM OpenPages with Watson · CVSS 7.1 High · Not analysed yet · Published 20 Feb 2025 · Tags: XML external entities (XXE)
- [IBM Cognos Controller XML external entity injection](https://agentprime.io/advisories/CVE-2023-47160.md)
  `CVE-2023-47160` · CVE record: IBM Cognos Controller and 1 more · CVSS 8.2 High · Not analysed yet · Published 19 Feb 2025 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDI1LTAyLTE5VDE2OjIwOjA5LjA1ODAwMFoiLCJDVkUtMjAyMy00NzE2MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDI1LTA3LTE5VDEzOjAyOjA1LjQzNDAwMFoiLCJDVkUtMjAyNS03ODI0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDI1LTA3LTE5VDEzOjAyOjA1LjQzNDAwMFoiLCJDVkUtMjAyNS03ODI0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.