# XML external entities (XXE). XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [XML external entity injection in RSA Authentication Manager](https://agentprime.io/advisories/CVE-2024-25066.md) `CVE-2024-25066` · CVE record: RSA Authentication Manager · CVSS 4.3 Medium · Not analysed yet · Published 17 Feb 2025 · Tags: XML external entities (XXE) - [ywoa WXCallBack Interface XMLParse.java extract xml external entity reference](https://agentprime.io/advisories/CVE-2025-1225.md) `CVE-2025-1225` · CVE record: ywoa · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2025 · Tags: XML external entities (XXE), CWE-610 - [IBM EntireX XML external entity injection](https://agentprime.io/advisories/CVE-2024-54171.md) `CVE-2024-54171` · CVE record: IBM EntireX · CVSS 7.1 High · Not analysed yet · Published 6 Feb 2025 · Tags: XML external entities (XXE) - [IBM Cognos Anaytics XML external entity injection](https://agentprime.io/advisories/CVE-2024-49352.md) `CVE-2024-49352` · CVE record: IBM Cognos Analytics · CVSS 7.1 High · Not analysed yet · Published 5 Feb 2025 · Tags: XML external entities (XXE) - [XXE vulnerability in XSLT parsing in \`org.hl7.fhir.publisher\`](https://agentprime.io/advisories/GHSA-8c3x-hq82-gjcm.md) `GHSA-8c3x-hq82-gjcm`, `CVE-2024-52807` · Maven `org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli` and 1 more: affected `<1.7.4`, fixed in `1.7.4` · CVSS 8.6 High · Not analysed yet · Published 24 Jan 2025 · Tags: XML external entities (XXE) - [HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks](https://agentprime.io/advisories/CVE-2024-42185.md) `CVE-2024-42185` · CVE record: HCL Software BigFix Patch Management Download Plug-ins · CVSS 2.5 Low · Not analysed yet · Published 23 Jan 2025 · Tags: XML external entities (XXE) - [Apache Ambari: XML External Entity (XXE) Vulnerability in Ambari/Oozie](https://agentprime.io/advisories/CVE-2025-23195.md) `CVE-2025-23195` · CVE record: Apache Software Foundation Apache Ambari · CVSS 7.5 High · Not analysed yet · Published 21 Jan 2025 · Tags: XML external entities (XXE) - [XML external entity injection in Schneider Electric Web Designer for BMXNOR0200H and others](https://agentprime.io/advisories/CVE-2024-12476.md) `CVE-2024-12476` · CVE record: Schneider Electric Web Designer for BMXNOR0200H and 3 more · CVSS 8.4 High · Not analysed yet · Published 17 Jan 2025 · Tags: XML external entities (XXE) - [Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer](https://agentprime.io/advisories/CVE-2024-12298.md) `CVE-2024-12298` · CVE record: OMRON Corporation Programable Terminals NB-Designer · CVSS 5.5 Medium · Not analysed yet · Published 14 Jan 2025 · Tags: XML external entities (XXE) - [An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.](https://agentprime.io/advisories/CVE-2024-46603.md) `CVE-2024-46603` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2025 · Tags: XML external entities (XXE) - [An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier.](https://agentprime.io/advisories/CVE-2024-46602.md) `CVE-2024-46602` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2025 · Tags: XML external entities (XXE) - [GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins](https://agentprime.io/advisories/CVE-2024-56324.md) `CVE-2024-56324` · CVE record: gocd gocd · CVSS 2.1 Low · Not analysed yet · Published 3 Jan 2025 · Tags: XML external entities (XXE) - [GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality](https://agentprime.io/advisories/CVE-2024-56322.md) `CVE-2024-56322` · CVE record: gocd gocd · CVSS 2.1 Low · Not analysed yet · Published 3 Jan 2025 · Tags: XML external entities (XXE) - [XML external entity injection in libxml2](https://agentprime.io/advisories/CVE-2024-40896.md) `CVE-2024-40896` · CVE record: libxml2 libxml2 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Dec 2024 · Tags: XML external entities (XXE) - [XML external entity injection in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2024-56356.md) `CVE-2024-56356` · CVE record: JetBrains TeamCity · CVSS 5.9 Medium · Not analysed yet · Published 20 Dec 2024 · Tags: XML external entities (XXE) - [XML external entity injection in OpenText™ Operations Bridge Manager](https://agentprime.io/advisories/CVE-2021-22501.md) `CVE-2021-22501` · CVE record: OpenText™ Operations Bridge Manager · CVSS 5.3 Medium · Not analysed yet · Published 19 Dec 2024 · Tags: XML external entities (XXE) - [An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplying a crafted XML input.](https://agentprime.io/advisories/CVE-2024-55081.md) `CVE-2024-55081` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Dec 2024 · Tags: XML external entities (XXE) - [Ucum-java has an XXE vulnerability in XML parsing](https://agentprime.io/advisories/GHSA-w9j7-phm3-f97j.md) `GHSA-w9j7-phm3-f97j`, `CVE-2024-55887` · Maven `org.fhir:ucum`: affected `<1.0.9`, fixed in `1.0.9` · CVSS 8.6 High · Not analysed yet · Published 13 Dec 2024 · Tags: XML external entities (XXE) - [http4k has a potential XXE (XML External Entity Injection) vulnerability](https://agentprime.io/advisories/GHSA-7mj5-hjjj-8rgw.md) `GHSA-7mj5-hjjj-8rgw`, `CVE-2024-55875` · Maven `org.http4k:http4k-format-xml`: affected `<6.50.0.0`, fixed in `6.50.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Dec 2024 · Tags: Information disclosure, XML external entities (XXE), Server-side request forgery (SSRF) - [CVE-2024-46455 in github.com/Unstructured-IO/unstructured](https://agentprime.io/advisories/GHSA-32r8-54hf-c9p3.md) `GHSA-32r8-54hf-c9p3`, `CVE-2024-46455`, `GO-2024-3315`, `PYSEC-2026-1993` · Go `github.com/Unstructured-IO/unstructured`: affected `*`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Dec 2024 · Tags: XML external entities (XXE) - [Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2024-49535.md) `CVE-2024-49535` · CVE record: Adobe Acrobat Reader · CVSS 6.3 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: XML external entities (XXE) - [Microsoft SharePoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-49064.md) `CVE-2024-49064` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Siemens COMOS V10.3 and others](https://agentprime.io/advisories/CVE-2024-54005.md) `CVE-2024-54005` · CVE record: Siemens COMOS V10.3 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Siemens COMOS V10.3 and others](https://agentprime.io/advisories/CVE-2024-49704.md) `CVE-2024-49704` · CVE record: Siemens COMOS V10.3 and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: XML external entities (XXE) - [XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA](https://agentprime.io/advisories/CVE-2024-47582.md) `CVE-2024-47582` · CVE record: SAP_SE SAP NetWeaver AS JAVA · CVSS 5.3 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: XML external entities (XXE) - [SimpleSAMLphp vulnerable to XXE in parsing SAML messages](https://agentprime.io/advisories/GHSA-j5g2-q29x-cw3h.md) `GHSA-j5g2-q29x-cw3h` · Packagist `simplesamlphp/simplesamlphp`: affected `<2.0.15 || >=2.1.0, <2.1.7 || >=2.2.0, <2.2.4 || >=2.3.0, <2.3.4`, fixed in `2.0.15`, `2.1.7`, `2.2.4`, `2.3.4` · CVSS 8.3 High · Withdrawn · Not analysed yet · Published 2 Dec 2024 · Tags: XML external entities (XXE) - [SimpleSAMLphp SAML2 has an XXE in parsing SAML messages](https://agentprime.io/advisories/GHSA-pxm4-r5ph-q2m2.md) `GHSA-pxm4-r5ph-q2m2`, `CVE-2024-52806`, `PKSA-1983-c8jn-trgm`, `PKSA-mvk4-j13p-n98v` · Packagist `simplesamlphp/saml2` and 1 more: affected `<4.6.14`, fixed in `4.6.14` · CVSS 8.3 High · Not analysed yet · Published 2 Dec 2024 · Tags: XML external entities (XXE) - [veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability](https://agentprime.io/advisories/GHSA-4cx5-89vm-833x.md) `GHSA-4cx5-89vm-833x`, `CVE-2024-52800` · Maven `org.verapdf:core` and 8 more: affected `<1.26.2`, fixed in `1.26.2` · CVSS 2.3 Low · Not analysed yet · Published 2 Dec 2024 · Tags: XML external entities (XXE) - [SimpleSAMLphp xml-common XXE vulnerability](https://agentprime.io/advisories/GHSA-2x65-fpch-2fcm.md) `GHSA-2x65-fpch-2fcm`, `CVE-2024-52596`, `PKSA-p6my-43pz-jn9t` · Packagist `simplesamlphp/xml-common`: affected `<1.20.0`, fixed in `1.20.0` · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2024 · Tags: XML external entities (XXE) - [XML External Entity (XXE) Vulnerability in EasyTax](https://agentprime.io/advisories/CVE-2024-9044.md) `CVE-2024-9044` · CVE record: msg Suisse AG EasyTax · CVSS 4.6 Medium · Not analysed yet · Published 29 Nov 2024 · Tags: XML external entities (XXE) - [Possible XML External Entity Injection in OpenText iManager](https://agentprime.io/advisories/CVE-2023-24466.md) `CVE-2023-24466` · CVE record: OpenText iManager · CVSS 7.5 High · Not analysed yet · Published 22 Nov 2024 · Tags: XML external entities (XXE) - [XXE in PHPSpreadsheet's XLSX reader](https://agentprime.io/advisories/GHSA-7cc9-j4mv-vcjp.md) `GHSA-7cc9-j4mv-vcjp`, `CVE-2024-48917`, `PKSA-gst3-cdk3-bpqt`, `PKSA-j2jw-2hjb-39hn` · Packagist `phpoffice/phpexcel` and 1 more: affected `<=1.8.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2024 · Tags: XML external entities (XXE) - [XmlScanner bypass leads to XXE](https://agentprime.io/advisories/GHSA-jw4x-v69f-hh5w.md) `GHSA-jw4x-v69f-hh5w`, `CVE-2024-47873`, `PKSA-dbrb-pvhs-h3st`, `PKSA-yb2q-9cbc-scfr` · Packagist `phpoffice/phpexcel` and 1 more: affected `<=1.8.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2024 · Tags: XML external entities (XXE) - [Cisco SD-WAN vManage Software XML External Entity Vulnerability](https://agentprime.io/advisories/CVE-2020-26066.md) `CVE-2020-26066` · CVE record: Cisco Cisco Catalyst SD-WAN Manager · CVSS 6.5 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: XML external entities (XXE) - [An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via…](https://agentprime.io/advisories/CVE-2024-50848.md) `CVE-2024-50848` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: XML external entities (XXE) - [Cisco SD-WAN vManage Software XML External Entity Vulnerability](https://agentprime.io/advisories/CVE-2021-1483.md) `CVE-2021-1483` · CVE record: Cisco Cisco Catalyst SD-WAN Manager · CVSS 6.4 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: XML external entities (XXE) - [IBM Engineering Insights XML external entity injection](https://agentprime.io/advisories/CVE-2024-39726.md) `CVE-2024-39726` · CVE record: IBM Engineering Insights · CVSS 8.2 High · Not analysed yet · Published 15 Nov 2024 · Tags: XML external entities (XXE) - [Improper Restriction of XML External Entity Reference in dompdf/dompdf](https://agentprime.io/advisories/GHSA-3vjh-xrhf-v9xh.md) `GHSA-3vjh-xrhf-v9xh`, `CVE-2021-3902`, `PKSA-qstp-ffwg-8hp6` · Packagist `dompdf/dompdf`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Nov 2024 · Tags: XML external entities (XXE) - [PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability](https://agentprime.io/advisories/CVE-2024-5919.md) `CVE-2024-5919` · CVE record: Palo Alto Networks Cloud NGFW and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: XML external entities (XXE) - [TIBCO Hawk Stored-XEE Vulnerability](https://agentprime.io/advisories/CVE-2024-10218.md) `CVE-2024-10218` · CVE record: TIBCO Software Inc TIBCO Hawk and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Nov 2024 · Tags: XML external entities (XXE) - [XXE vulnerability in XSLT parsing in \`org.hl7.fhir.core\`](https://agentprime.io/advisories/GHSA-gr3c-q7xf-47vh.md) `GHSA-gr3c-q7xf-47vh`, `CVE-2024-52007` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may` and 5 more: affected `<6.4.0`, fixed in `6.4.0` · CVSS 8.6 High · Not analysed yet · Published 8 Nov 2024 · Tags: XML external entities (XXE) - [XML External Entity](https://agentprime.io/advisories/CVE-2024-10839.md) `CVE-2024-10839` · CVE record: ManageEngine SharePoint Manager Plus · CVSS 8.5 High · Not analysed yet · Published 8 Nov 2024 · Tags: XML external entities (XXE) - [PHPExcel XXE Vulnerability](https://agentprime.io/advisories/GHSA-3m9x-2qfj-xvq4.md) `GHSA-3m9x-2qfj-xvq4`, `CVE-2015-3542`, `PKSA-22dg-9jng-vjc5` · Packagist `phpoffice/phpexcel`: affected `<1.8.1`, fixed in `1.8.1` · CVSS 4.0, no score published · Not analysed yet · Published 7 Nov 2024 · Tags: XML external entities (XXE) - [Cisco Identity Services Engine XML External Entity Injection Vulnerability](https://agentprime.io/advisories/CVE-2024-20531.md) `CVE-2024-20531` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 5.5 Medium · Not analysed yet · Published 6 Nov 2024 · Tags: XML external entities (XXE) - [HAPI FHIR XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-4cf2-cxp3-rjr7.md) `GHSA-4cf2-cxp3-rjr7`, `CVE-2024-51132` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.convertors` and 8 more: affected `<6.4.0`, fixed in `6.4.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2024 · Tags: Open redirect, XML external entities (XXE) - [IBM WebSphere Application Server XML external entity injection](https://agentprime.io/advisories/CVE-2024-45086.md) `CVE-2024-45086` · CVE record: IBM WebSphere Application Server · CVSS 5.5 Medium · Not analysed yet · Published 4 Nov 2024 · Tags: XML external entities (XXE) - [WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/CVE-2024-50442.md) `CVE-2024-50442` · CVE record: WP Royal Royal Elementor Addons · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2024 · Tags: XML external entities (XXE) - [Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools](https://agentprime.io/advisories/CVE-2024-4690.md) `CVE-2024-4690` · CVE record: OpenText OpenText Application Automation Tools · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: XML external entities (XXE) - [Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools](https://agentprime.io/advisories/CVE-2024-4189.md) `CVE-2024-4189` · CVE record: OpenText OpenText Application Automation Tools · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: XML external entities (XXE) - [Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools](https://agentprime.io/advisories/CVE-2024-4184.md) `CVE-2024-4184` · CVE record: OpenText OpenText Application Automation Tools · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: XML external entities (XXE) - [IBM WebSphere Application Server XML external entity injection](https://agentprime.io/advisories/CVE-2024-45072.md) `CVE-2024-45072` · CVE record: IBM WebSphere Application Server · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2024-21255.md) `CVE-2024-21255` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2024 · Tags: XML external entities (XXE) - [XML Eternal Entity Attack in the Software Library taxstatement.jar](https://agentprime.io/advisories/CVE-2024-8602.md) `CVE-2024-8602` · CVE record: Schweizerische Steuerkonferenz Library taxstatement.jar · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2024 · Tags: XML external entities (XXE) - [Apache XML Graphics FOP XML External Entity Reference ('XXE') vulnerability](https://agentprime.io/advisories/GHSA-jqfv-jrvq-95jm.md) `GHSA-jqfv-jrvq-95jm`, `CVE-2024-28168` · Maven `org.apache.xmlgraphics:fop-core`: affected `<2.10`, fixed in `2.10` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2024 · Tags: XML external entities (XXE) - [XML external entity injection in Dell AppSync](https://agentprime.io/advisories/CVE-2024-39586.md) `CVE-2024-39586` · CVE record: Dell AppSync · CVSS 2.9 Low · Not analysed yet · Published 9 Oct 2024 · Tags: XML external entities (XXE) - [XXE in PHPSpreadsheet's XLSX reader](https://agentprime.io/advisories/GHSA-6hwr-6v2f-3m88.md) `GHSA-6hwr-6v2f-3m88`, `CVE-2024-45293`, `PKSA-mkg2-1wyw-57y7`, `PKSA-xzzd-fyzv-1nm2` · Packagist `phpoffice/phpexcel` and 1 more: affected `<=1.8.2`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2024 · Tags: XML external entities (XXE) - [TopQuadrant TopBraid EDG JavaScript console XXE](https://agentprime.io/advisories/CVE-2024-45745.md) `CVE-2024-45745` · CVE record: TopQuadrant TopBraid EDG · CVSS 5.0 Medium · Not analysed yet · Published 27 Sept 2024 · Tags: XML external entities (XXE) - [DataEase has an XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-4m9p-7xg6-f4mm.md) `GHSA-4m9p-7xg6-f4mm`, `CVE-2024-46985` · Maven `io.dataease:common`: affected `<2.10.1`, fixed in `2.10.1` · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2024 · Tags: XML external entities (XXE) - [Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack](https://agentprime.io/advisories/GHSA-68j8-fp38-p48q.md) `GHSA-68j8-fp38-p48q`, `CVE-2024-46984` · Maven `de.gematik.refv.commons:commons`: affected `<2.5.1`, fixed in `2.5.1` · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2024 · Tags: XML external entities (XXE) - [Kimai has an XXE Leading to Local File Read](https://agentprime.io/advisories/GHSA-534c-hcr7-67jg.md) `GHSA-534c-hcr7-67jg`, `PKSA-xxx2-wfk5-mvc4` · Packagist `kimai/kimai`: affected `<2.21.0`, fixed in `2.21.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2024 · Tags: XML external entities (XXE), CWE-1395 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .