# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [XML Entity Expansion (XEE) in Django](https://agentprime.io/advisories/GHSA-qrh7-x6fp-c2mp.md)
  `GHSA-qrh7-x6fp-c2mp`, `CVE-2013-1664`, `PYSEC-2026-801` · PyPI `django`: affected `>=1.3.0, <1.3.6 || >=1.4.0, <1.4.4`, fixed in `1.3.6`, `1.4.4` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) in Django](https://agentprime.io/advisories/GHSA-x64m-686f-fmm3.md)
  `GHSA-x64m-686f-fmm3`, `CVE-2013-1665`, `PYSEC-2026-802` · PyPI `django`: affected `>=1.3.0, <1.3.6 || >=1.4.0, <1.4.4`, fixed in `1.3.6`, `1.4.4` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: Information disclosure, XML external entities (XXE)
- [CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references](https://agentprime.io/advisories/GHSA-5964-pq8r-4q62.md)
  `GHSA-5964-pq8r-4q62`, `CVE-2012-4399`, `PKSA-cj1b-7h6y-vc5q` · Packagist `cakephp/cakephp`: affected `>=2.1.0-alpha, <2.1.5 || >=2.2.0-beta, <2.2.1`, fixed in `2.1.5`, `2.2.1` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Zend Framework XXE Vulnerability](https://agentprime.io/advisories/GHSA-7pg4-5233-82jv.md)
  `GHSA-7pg4-5233-82jv`, `CVE-2012-3363`, `PKSA-9336-p9y5-q64w` · Packagist `zendframework/zendframework1`: affected `>=1.0.0, <1.11.12 || >=1.12.0-rc1, <1.12.0`, fixed in `1.11.12`, `1.12.0` · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.49 · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache Solr](https://agentprime.io/advisories/GHSA-6cpj-3g83-q2j4.md)
  `GHSA-6cpj-3g83-q2j4`, `CVE-2012-6612` · Maven `org.apache.solr:solr-core`: affected `<4.1.0`, fixed in `4.1.0` · No CVSS score · EPSS 0.10 · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [SOAPpy vulnerable to XML External Entity attacks](https://agentprime.io/advisories/GHSA-52wr-3vww-rmpq.md)
  `GHSA-52wr-3vww-rmpq`, `CVE-2014-3242`, `PYSEC-2026-924` · PyPI `soappy`: affected `<=0.12.5`, no fixed version yet · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [PHPExcel vulnerable to XXE attacks through libxml](https://agentprime.io/advisories/GHSA-28rm-rj57-qjpv.md)
  `GHSA-28rm-rj57-qjpv`, `CVE-2014-2054`, `PKSA-mfm1-71w2-z7mz` · Packagist `phpoffice/phpexcel`: affected `<1.8.0`, fixed in `1.8.0` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Apache Solr UpdateRequestHandler for XML resolves XML External Entities](https://agentprime.io/advisories/GHSA-998j-j6v9-5846.md)
  `GHSA-998j-j6v9-5846`, `CVE-2013-6407` · Maven `org.apache.solr:solr-core`: affected `<4.1.0`, fixed in `4.1.0` · No CVSS score · EPSS 0.11 · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in RESTEasy](https://agentprime.io/advisories/GHSA-pc54-pchm-xcw6.md)
  `GHSA-pc54-pchm-xcw6`, `CVE-2014-7839` · Maven `org.jboss.resteasy:resteasy-jaxrs`: affected `<3.0.11.Final`, fixed in `3.0.11.Final` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE), CWE-20
- [ZendXml and Zend Framework contain XXE and XEE Vulnerabilities](https://agentprime.io/advisories/GHSA-xp8p-9rq5-4wgv.md)
  `GHSA-xp8p-9rq5-4wgv`, `CVE-2015-5161`, `PKSA-wj3f-s5xk-69k6`, `PKSA-wkm6-gzx7-1qtv`, `PKSA-zb12-j4m8-9hsy` · Packagist `zendframework/zendframework` and 2 more: affected `>=1.12.0, <1.12.14 || >=2.0.0, <2.4.6 || >=2.5.0, <2.5.2`, fixed in `1.12.14`, `2.4.6`, `2.5.2` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE), Denial of service
- [getID3 is vulnerable to XML External Entity (XXE)](https://agentprime.io/advisories/GHSA-5v43-55m5-qr8f.md)
  `GHSA-5v43-55m5-qr8f`, `CVE-2014-2053`, `PKSA-jm5q-b1sm-tp44` · Packagist `james-heinrich/getid3`: affected `<1.9.9`, fixed in `1.9.9` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Openpyxl](https://agentprime.io/advisories/GHSA-chqf-hx79-gxc6.md)
  `GHSA-chqf-hx79-gxc6`, `CVE-2017-5992`, `PYSEC-2017-48` · PyPI `openpyxl`: affected `<2.4.2`, fixed in `2.4.2` · CVSS 8.2 High · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [PySAML2 XML external entity attack](https://agentprime.io/advisories/GHSA-m269-wj6g-c459.md)
  `GHSA-m269-wj6g-c459`, `CVE-2016-10127`, `PYSEC-2017-67` · PyPI `pysaml2`: affected `<4.5.0`, fixed in `4.5.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Apache OpenMeetings does not correctly validate uploaded XML documents](https://agentprime.io/advisories/GHSA-67q3-gwww-pm4g.md)
  `GHSA-67q3-gwww-pm4g`, `CVE-2017-7664` · Maven `org.apache.openmeetings:openmeetings-parent`: affected `>=3.1.0, <3.3.0`, fixed in `3.3.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Apache Sling](https://agentprime.io/advisories/GHSA-7g54-vgp6-jj5w.md)
  `GHSA-7g54-vgp6-jj5w`, `CVE-2016-6798` · Maven `org.apache.sling:org.apache.sling.xss` and 1 more: affected `<1.0.12`, fixed in `1.0.12` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [phpMyAdmin vulnerable to XML external entity (XXE) injection attack](https://agentprime.io/advisories/GHSA-q4mm-89q2-xffg.md)
  `GHSA-q4mm-89q2-xffg`, `CVE-2011-4107`, `PKSA-rmn1-gxrc-4qyq` · Packagist `phpmyadmin/phpmyadmin`: affected `>=3.3.0, <3.3.10.5 || >=3.4.0, <3.4.7.1`, fixed in `3.3.10.5`, `3.4.7.1` · CVSS 6.5 Medium · EPSS 0.13 · Not analysed yet · Published 17 May 2022 · Tags: Information disclosure, XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache POI](https://agentprime.io/advisories/GHSA-q56h-jjj6-52mf.md)
  `GHSA-q56h-jjj6-52mf`, `CVE-2014-3529` · Maven `org.apache.poi:poi`: affected `<3.10.1`, fixed in `3.10.1` · No CVSS score · EPSS 0.13 · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Jelly](https://agentprime.io/advisories/GHSA-6g33-82gc-3pw5.md)
  `GHSA-6g33-82gc-3pw5`, `CVE-2017-12621` · Maven `commons-jelly:commons-jelly`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Umbraco CMS XXE Vulnerability](https://agentprime.io/advisories/GHSA-h2vq-7gf2-qw9v.md)
  `GHSA-h2vq-7gf2-qw9v`, `CVE-2017-15280` · NuGet `UmbracoCms.Web`: affected `<7.7.3`, fixed in `7.7.3` · CVSS 5.5 Medium · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache OpenNLP](https://agentprime.io/advisories/GHSA-h22x-hm8g-rxpg.md)
  `GHSA-h22x-hm8g-rxpg`, `CVE-2017-12620` · Maven `org.apache.opennlp:opennlp-tools`: affected `>=1.5.0, <1.8.2`, fixed in `1.8.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Apache NiFi](https://agentprime.io/advisories/GHSA-qj7f-j6h9-g5rq.md)
  `GHSA-qj7f-j6h9-g5rq`, `CVE-2017-12623` · Maven `org.apache.nifi:nifi`: affected `>=1.0.0, <1.4.0`, fixed in `1.4.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in org.picketlink:picketlink-common](https://agentprime.io/advisories/GHSA-2c9q-qwrc-f486.md)
  `GHSA-2c9q-qwrc-f486`, `CVE-2014-3530` · Maven `org.picketlink:picketlink-common`: affected `<2.7.0.Final`, fixed in `2.7.0.Final` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XXE Vulnerability in XMLBundle 0.1.7](https://agentprime.io/advisories/GHSA-qvwf-w35m-6r95.md)
  `GHSA-qvwf-w35m-6r95`, `CVE-2017-1000477`, `PKSA-d719-gcgf-8wxx` · Packagist `desperado/xml-bundle`: affected `<=0.1.7`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins DRY Plugin](https://agentprime.io/advisories/GHSA-x7qf-qh3r-mx22.md)
  `GHSA-x7qf-qh3r-mx22`, `CVE-2018-1000010` · Maven `org.jvnet.hudson.plugins:dry`: affected `<2.50`, fixed in `2.50` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Checkstyle Plugin](https://agentprime.io/advisories/GHSA-jfj9-7j5w-6xgx.md)
  `GHSA-jfj9-7j5w-6xgx`, `CVE-2018-1000009` · Maven `org.jvnet.hudson.plugins:checkstyle`: affected `<3.50`, fixed in `3.50` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins PMD Plugin](https://agentprime.io/advisories/GHSA-687x-269m-7cv9.md)
  `GHSA-687x-269m-7cv9`, `CVE-2018-1000008` · Maven `org.jvnet.hudson.plugins:pmd`: affected `<3.50`, fixed in `3.50` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Jenkins FindBugs Plugin](https://agentprime.io/advisories/GHSA-pr9h-g7p7-rrqh.md)
  `GHSA-pr9h-g7p7-rrqh`, `CVE-2018-1000011` · Maven `org.jvnet.hudson.plugins.findbugs:library`: affected `<=4.7.1`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability Jenkins Warnings Plugin](https://agentprime.io/advisories/GHSA-p498-rpcw-3578.md)
  `GHSA-p498-rpcw-3578`, `CVE-2018-1000012` · Maven `org.jvnet.hudson.plugins:warnings`: affected `<4.65`, fixed in `4.65` · CVSS 8.8 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin](https://agentprime.io/advisories/GHSA-4rj6-9pjh-882r.md)
  `GHSA-4rj6-9pjh-882r`, `CVE-2018-1000056` · Maven `org.jenkins-ci.plugins:junit`: affected `<1.24`, fixed in `1.24` · CVSS 8.3 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Android Lint Plugin](https://agentprime.io/advisories/GHSA-3vcx-w94h-68vg.md)
  `GHSA-3vcx-w94h-68vg`, `CVE-2018-1000055` · Maven `org.jvnet.hudson.plugins:android-lint`: affected `<2.6`, fixed in `2.6` · CVSS 8.3 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [mxGraph vulnerable to XXE attacks](https://agentprime.io/advisories/GHSA-wvpv-8524-wg6x.md)
  `GHSA-wvpv-8524-wg6x`, `CVE-2017-18197` · npm `mxgraph`: affected `<3.7.6`, fixed in `3.7.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-c4mp-h3m2-h5mc.md)
  `GHSA-c4mp-h3m2-h5mc`, `CVE-2018-1000054` · Maven `org.jvnet.hudson.plugins:ccm`: affected `<3.2`, fixed in `3.2` · CVSS 8.3 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache NiFi](https://agentprime.io/advisories/GHSA-42wx-65g4-5cxv.md)
  `GHSA-42wx-65g4-5cxv`, `CVE-2018-1309` · Maven `org.apache.nifi:nifi-standard-processors`: affected `>=0.1.0, <1.6.0`, fixed in `1.6.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity processing vulnerability in Jenkins Black Duck Hub Plugin](https://agentprime.io/advisories/GHSA-8rc4-3jc3-83pm.md)
  `GHSA-8rc4-3jc3-83pm`, `CVE-2018-1000198` · Maven `com.blackducksoftware.integration:blackduck-hub`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [WeChat Pay Java SDK allows XXE](https://agentprime.io/advisories/GHSA-gqgv-2gp3-qqp3.md)
  `GHSA-gqgv-2gp3-qqp3`, `CVE-2018-13439` · Maven `com.github.wxpay:wxpay-sdk`: affected `<=3`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [PHPOffice Common Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-2853-hf2g-9843.md)
  `GHSA-2853-hf2g-9843`, `CVE-2018-14065`, `PKSA-v5rb-92cx-94h1` · Packagist `phpoffice/common`: affected `<0.2.9`, fixed in `0.2.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Apache ActiveMQ](https://agentprime.io/advisories/GHSA-x6rc-54xp-ccxx.md)
  `GHSA-x6rc-54xp-ccxx`, `CVE-2015-3208` · Maven `org.apache.activemq:activemq-client`: affected `<2.23.1`, fixed in `2.23.1` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Apache Cayenne](https://agentprime.io/advisories/GHSA-85hw-w436-c725.md)
  `GHSA-85hw-w436-c725`, `CVE-2018-11758` · Maven `org.apache.cayenne:cayenne-parent`: affected `<3.1.3 || >=4.0, <4.1`, fixed in `3.1.3`, `4.1` · CVSS 8.1 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Apache XML-RPC XXE Vulnerability](https://agentprime.io/advisories/GHSA-wp35-6jqv-r33m.md)
  `GHSA-wp35-6jqv-r33m`, `CVE-2016-5002` · Maven `org.apache.xmlrpc:xmlrpc`: affected `<=3.1.3`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in weixin-java-tools](https://agentprime.io/advisories/GHSA-h755-h99p-9ffv.md)
  `GHSA-h755-h99p-9ffv`, `CVE-2019-5312` · Maven `com.github.binarywang:weixin-java-common`: affected `<3.3.2.B`, fixed in `3.3.2.B` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in PMD](https://agentprime.io/advisories/GHSA-57qj-79gh-69w8.md)
  `GHSA-57qj-79gh-69w8`, `CVE-2019-7722` · Maven `net.sourceforge.pmd:pmd-core`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 8.1 High · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Apache ActiveMQ Apollo XXE Vulnerability](https://agentprime.io/advisories/GHSA-wmhw-hpwh-44pg.md)
  `GHSA-wmhw-hpwh-44pg`, `CVE-2014-3579` · Maven `org.apache.activemq:apollo-project`: affected `>=1.0.0, <1.7.1`, fixed in `1.7.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache ActiveMQ](https://agentprime.io/advisories/GHSA-4vhf-2hv7-8mrx.md)
  `GHSA-4vhf-2hv7-8mrx`, `CVE-2014-3600` · Maven `org.apache.activemq:activemq-broker` and 1 more: affected `>=5.0.0, <5.10.1`, fixed in `5.10.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache uimaj](https://agentprime.io/advisories/GHSA-wp2f-hrg2-3r5m.md)
  `GHSA-wp2f-hrg2-3r5m`, `CVE-2017-15691` · Maven `org.apache.uima:uimafit-core` and 2 more: affected `<2.4.0`, fixed in `2.4.0` · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [Several Zend Products Vulnerable to XXE and XEE attacks](https://agentprime.io/advisories/GHSA-gp39-h9c2-qw79.md)
  `GHSA-gp39-h9c2-qw79`, `CVE-2014-2682`, `PKSA-1r37-7qvp-t27r`, `PKSA-1xrh-th2b-h125`, `PKSA-7jnn-xn3f-kf8r`, `PKSA-8sd1-cgng-jc6r`, `PKSA-cx4k-ymwj-ynpz`, `PKSA-fbyj-5c8s-nj62`, `PKSA-fsmn-qkkg-bqqj`, `PKSA-khwk-wq71-chd1`, `PKSA-nhpc-7wt4-89db`, `PKSA-w84w-b2yb-ybtv` · Packagist `zendframework/zendframework1` and 9 more: affected `<1.12.4`, fixed in `1.12.4` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE), Denial of service
- [Several Zend Products Vulnerable to XXE and XEE attacks](https://agentprime.io/advisories/GHSA-5wm2-38q5-5rxv.md)
  `GHSA-5wm2-38q5-5rxv`, `CVE-2014-2683`, `PKSA-1fx2-ghnw-xh34`, `PKSA-1s8s-q3yx-tzcj`, `PKSA-58bk-z3mm-63nw`, `PKSA-7tbc-4p3k-67wb`, `PKSA-g1pm-yv1d-z1y9`, `PKSA-pgnn-2m2c-rqqp`, `PKSA-rhmd-33xb-w86d`, `PKSA-rxqb-xqsf-vrqt`, `PKSA-t4gx-vs5z-h7s9`, `PKSA-vht6-8r6w-vzyb` · Packagist `zendframework/zendframework1` and 9 more: affected `<1.12.4`, fixed in `1.12.4` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE), Denial of service
- [Several Zend Products Vulnerable to XXE and XEE attacks](https://agentprime.io/advisories/GHSA-43xg-87xw-jpv8.md)
  `GHSA-43xg-87xw-jpv8`, `CVE-2014-2681`, `PKSA-29tt-qmdg-n7dc`, `PKSA-4zyp-431k-4s26`, `PKSA-89hm-v2gs-cs2v`, `PKSA-gr8m-tjh9-8c2p`, `PKSA-hwb1-prtb-wfjt`, `PKSA-p6xm-8krb-z646`, `PKSA-r3w9-4kc6-t3j4`, `PKSA-s1wb-6dxp-cygd`, `PKSA-vx12-2b3m-kdbc`, `PKSA-x1xp-mbsx-211w` · Packagist `zendframework/zendframework1` and 9 more: affected `<1.12.4`, fixed in `1.12.4` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [SimpleXML has XML External Entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-f5qf-vh69-9q4r.md)
  `GHSA-f5qf-vh69-9q4r`, `CVE-2017-1000190` · Maven `org.simpleframework:simple-xml`: affected `<2.7.1`, fixed in `2.7.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in jbpmmigration](https://agentprime.io/advisories/GHSA-vc3x-72q4-g3p5.md)
  `GHSA-vc3x-72q4-g3p5`, `CVE-2017-7545` · Maven `org.jbpm.jbpm5:jbpmmigration`: affected `<=0.15`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Elasticsearch](https://agentprime.io/advisories/GHSA-ccmr-qj26-845g.md)
  `GHSA-ccmr-qj26-845g`, `CVE-2018-17247` · Maven `org.elasticsearch:elasticsearch`: affected `>=6.5.0, <6.5.2`, fixed in `6.5.2` · CVSS 5.9 Medium · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Job Import Plugin](https://agentprime.io/advisories/GHSA-882r-r8fw-p538.md)
  `GHSA-882r-r8fw-p538`, `CVE-2019-1003015` · Maven `org.jenkins-ci.plugins:job-import-plugin`: affected `<3.0`, fixed in `3.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Jenkins has XML External Entity (XXE) Vulnerability in Job Configuration via CLI](https://agentprime.io/advisories/GHSA-3j9c-cp7m-8w8g.md)
  `GHSA-3j9c-cp7m-8w8g`, `CVE-2015-5319` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=1.626, <1.638 || <1.625.2`, fixed in `1.638`, `1.625.2` · CVSS 4.0, no score published · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apace Derby](https://agentprime.io/advisories/GHSA-wr69-g62g-2r9h.md)
  `GHSA-wr69-g62g-2r9h`, `CVE-2015-1832` · Maven `org.apache.derby:derby`: affected `<10.12.1.1`, fixed in `10.12.1.1` · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability](https://agentprime.io/advisories/GHSA-pmqq-7wfv-jfff.md)
  `GHSA-pmqq-7wfv-jfff`, `CVE-2016-5000` · Maven `org.apache.poi:poi-examples`: affected `<3.14`, fixed in `3.14` · CVSS 5.5 Medium · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache Batik](https://agentprime.io/advisories/GHSA-qwgx-59jw-qfg9.md)
  `GHSA-qwgx-59jw-qfg9`, `CVE-2017-5662` · Maven `org.apache.xmlgraphics:batik`: affected `<1.9`, fixed in `1.9` · CVSS 7.3 High · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in iText](https://agentprime.io/advisories/GHSA-86p9-x5pw-94qx.md)
  `GHSA-86p9-x5pw-94qx`, `CVE-2017-9096` · Maven `com.itextpdf:itextpdf` and 1 more: affected `<5.5.12 || >=7.0.0, <7.0.3`, fixed in `5.5.12`, `7.0.3` · CVSS 8.8 High · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Moodle Arbitrary File Read via XML External Entity vulnerability](https://agentprime.io/advisories/GHSA-27j2-c838-c3qg.md)
  `GHSA-27j2-c838-c3qg`, `CVE-2014-3543`, `PKSA-2njy-8329-gfjv` · Packagist `moodle/moodle`: affected `<2.4.11 || >=2.5.0, <2.5.7 || >=2.6.0, <2.6.4 || >=2.7.0, <2.7.1`, fixed in `2.4.11`, `2.5.7`, `2.6.4`, `2.7.1` · No CVSS score · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS](https://agentprime.io/advisories/GHSA-x7xf-253v-x3w8.md)
  `GHSA-x7xf-253v-x3w8`, `CVE-2016-8739` · Maven `org.apache.cxf:cxf-core`: affected `<3.0.12 || >=3.1.0, <3.1.9`, fixed in `3.0.12`, `3.1.9` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache FOP](https://agentprime.io/advisories/GHSA-5hg8-r9vq-gjqp.md)
  `GHSA-5hg8-r9vq-gjqp`, `CVE-2017-5661` · Maven `org.apache.xmlgraphics:fop`: affected `<2.2`, fixed in `2.2` · CVSS 7.3 High · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in python-docx](https://agentprime.io/advisories/GHSA-34wj-p5jm-2p96.md)
  `GHSA-34wj-p5jm-2p96`, `CVE-2016-5851`, `PYSEC-2016-21` · PyPI `python-docx`: affected `<0.8.6`, fixed in `0.8.6` · CVSS 8.8 High · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDIyLTA1LTEzVDAxOjA2OjEwLjAwMDAwMFoiLCJHSFNBLTM0d2otcDVqbS0ycDk2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDIyLTA1LTE3VDA1OjEwOjQ2LjAwMDAwMFoiLCJHSFNBLTltNXYtdnE0Zi1tcnZmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDIyLTA1LTE3VDA1OjEwOjQ2LjAwMDAwMFoiLCJHSFNBLTltNXYtdnE0Zi1tcnZmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.