# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper Restriction of XML External Entity Reference in Castor](https://agentprime.io/advisories/GHSA-jwwr-fjgh-cv2x.md)
  `GHSA-jwwr-fjgh-cv2x`, `CVE-2014-3004` · Maven `castor:castor` and 1 more: affected `<=1.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Spring Framework](https://agentprime.io/advisories/GHSA-f93f-g33r-8pcp.md)
  `GHSA-f93f-g33r-8pcp`, `CVE-2014-0225` · Maven `org.springframework:spring-webmvc`: affected `>=4.0.0, <4.0.5 || >=3.0.0, <3.2.8`, fixed in `4.0.5`, `3.2.8` · CVSS 8.8 High · Not analysed yet · Published 13 May 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Siemens Teamcenter V12.4 and others](https://agentprime.io/advisories/CVE-2022-29801.md)
  `CVE-2022-29801` · CVE record: Siemens Teamcenter V12.4 and 1 more · No CVSS score · Not analysed yet · Published 10 May 2022 · Tags: XML external entities (XXE)
- [External Entity Reference in TwelveMonkeys ImageIO](https://agentprime.io/advisories/GHSA-pjch-4g28-fxx7.md)
  `GHSA-pjch-4g28-fxx7`, `CVE-2021-23792`, `SNYK-JAVA-COMTWELVEMONKEYSIMAGEIO-2316763` · Maven `com.twelvemonkeys.imageio:imageio-metadata`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 7.3 High · Not analysed yet · Published 7 May 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in apache jena](https://agentprime.io/advisories/GHSA-gchv-364h-r896.md)
  `GHSA-gchv-364h-r896`, `CVE-2022-28890` · Maven `org.apache.jena:jena`: affected `>=4.4.0, <4.5.0`, fixed in `4.5.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2022 · Tags: XML external entities (XXE)
- [Delta Electronics DMARS Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2022-1331.md)
  `CVE-2022-1331` · CVE record: Delta Electronics DMARS · CVSS 5.5 Medium · Not analysed yet · Published 3 May 2022 · Tags: XML external entities (XXE)
- [Multiple XXE vulnerabilities in OBS](https://agentprime.io/advisories/CVE-2022-21949.md)
  `CVE-2022-21949` · CVE record: SUSE Open Build Service · CVSS 8.8 High · Not analysed yet · Published 3 May 2022 · Tags: XML external entities (XXE)
- [Multiple components in Apache NiFi do not restrict XML External Entity references](https://agentprime.io/advisories/GHSA-wc97-7623-rxwx.md)
  `GHSA-wc97-7623-rxwx`, `BIT-nifi-2022-29265`, `CVE-2022-29265` · Maven `org.apache.nifi:nifi`: affected `>=0.0.1, <1.16.1`, fixed in `1.16.1` · CVSS 7.5 High · Not analysed yet · Published 1 May 2022 · Tags: XML external entities (XXE)
- [Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml](https://agentprime.io/advisories/GHSA-m2r5-4w96-qxg5.md)
  `GHSA-m2r5-4w96-qxg5`, `CVE-2022-24898` · Maven `org.xwiki.commons:xwiki-commons-xml`: affected `>=2.7, <12.10.10 || >=13.0.0, <13.4.4 || >=13.5-rc-1, <13.8-rc-1`, fixed in `12.10.10`, `13.4.4`, `13.8-rc-1` · CVSS 4.9 Medium · Not analysed yet · Published 28 Apr 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in detekt](https://agentprime.io/advisories/GHSA-2cfc-865j-gm4w.md)
  `GHSA-2cfc-865j-gm4w`, `CVE-2022-0272` · Maven `io.gitlab.arturbosch.detekt:detekt-core`: affected `<1.20.0`, fixed in `1.20.0` · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2022 · Tags: XML external entities (XXE)
- [ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform](https://agentprime.io/advisories/CVE-2021-43990.md)
  `CVE-2021-43990` · CVE record: FANUC ROBOGUIDE · CVSS 6.1 Medium · Not analysed yet · Published 20 Apr 2022 · Tags: XML external entities (XXE)
- [Inline DTD allows XML bomb attack](https://agentprime.io/advisories/GHSA-qpmc-wprv-x746.md)
  `GHSA-qpmc-wprv-x746`, `CVE-2019-15160` · Hex `sweet_xml`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 7.5 High · Not analysed yet · Published 12 Apr 2022 · Tags: XML external entities (XXE), Denial of service
- [ICSA-22-088-01 Rockwell Automation ISaGRAF](https://agentprime.io/advisories/CVE-2022-1018.md)
  `CVE-2022-1018` · CVE record: Rockwell Automation Connected Component Workbench and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 1 Apr 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in wutka jox](https://agentprime.io/advisories/GHSA-fcrx-8829-jpqx.md)
  `GHSA-fcrx-8829-jpqx`, `CVE-2021-43142` · Maven `com.wutka:jox`: affected `<=1.16`, no fixed version yet · No CVSS score · Not analysed yet · Published 1 Apr 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin](https://agentprime.io/advisories/GHSA-rwg2-w82x-v57j.md)
  `GHSA-rwg2-w82x-v57j`, `CVE-2022-28155` · Maven `com.surenpi.jenkins:phoenix-autotest`: affected `<=1.3`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 30 Mar 2022 · Tags: XML external entities (XXE)
- [XXE vulnerability in Jenkins Flaky Test Handler Plugin](https://agentprime.io/advisories/GHSA-v4rr-65x6-g69f.md)
  `GHSA-v4rr-65x6-g69f`, `CVE-2022-28140` · Maven `org.jenkins-ci.plugins:flaky-test-handler`: affected `<1.2.2`, fixed in `1.2.2` · CVSS 8.1 High · Not analysed yet · Published 30 Mar 2022 · Tags: XML external entities (XXE)
- [enkins Coverage/Complexity Scatter Plot Plugin XML External Entity Reference vulnerability](https://agentprime.io/advisories/GHSA-8rx6-v5q4-xw3j.md)
  `GHSA-8rx6-v5q4-xw3j`, `CVE-2022-28154` · Maven `org.jenkins-ci.plugins:covcomplplot`: affected `<=1.1.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 30 Mar 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Schneider Electric SCADAPack Workbench](https://agentprime.io/advisories/CVE-2022-0221.md)
  `CVE-2022-0221` · CVE record: Schneider Electric SCADAPack Workbench · CVSS 5.5 Medium · Not analysed yet · Published 28 Mar 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in soa-model](https://agentprime.io/advisories/GHSA-pv39-qp28-4mgh.md)
  `GHSA-pv39-qp28-4mgh`, `CVE-2021-43090` · Maven `com.predic8:soa-model-core` and 1 more: affected `<1.6.4`, fixed in `1.6.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2022 · Tags: XML external entities (XXE)
- [GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2021-44477.md)
  `CVE-2021-44477` · CVE record: GE Gas Power ToolBoxST · CVSS 7.5 High · Not analysed yet · Published 25 Mar 2022 · Tags: XML external entities (XXE)
- [ePO XML extended entity vulnerability](https://agentprime.io/advisories/CVE-2022-0861.md)
  `CVE-2022-0861` · CVE record: McAfee,LLC McAfee ePolicy Orchestrator (ePO) · CVSS 3.5 Low · Not analysed yet · Published 23 Mar 2022 · Tags: XML external entities (XXE)
- [XML external entity (XXE) attacks in Jenkins Xcode integration Plugin](https://agentprime.io/advisories/GHSA-wfxp-4qgw-qp3c.md)
  `GHSA-wfxp-4qgw-qp3c`, `CVE-2021-21656` · Maven `org.jenkins-ci.plugins:xcode-plugin`: affected `<2.0.15`, fixed in `2.0.15` · CVSS 7.1 High · Not analysed yet · Published 18 Mar 2022 · Tags: XML external entities (XXE)
- [XML external entity (XXE) injection in Apache Nutch](https://agentprime.io/advisories/GHSA-fxhp-wrw9-3r97.md)
  `GHSA-fxhp-wrw9-3r97`, `CVE-2021-23901` · Maven `org.apache.nutch:nutch`: affected `<1.18`, fixed in `1.18` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Mar 2022 · Tags: XML external entities (XXE)
- [XML External Entities Vulnerability in CVRF-CSAF-Converter](https://agentprime.io/advisories/GHSA-m8gq-83gh-v42v.md)
  `GHSA-m8gq-83gh-v42v`, `CVE-2022-27193`, `PYSEC-2026-627` · PyPI `cvrf2csaf`: affected `<1.0.0rc2`, fixed in `1.0.0rc2` · CVSS 6.1 Medium · Not analysed yet · Published 16 Mar 2022 · Tags: Information disclosure, XML external entities (XXE)
- [Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin](https://agentprime.io/advisories/GHSA-x3m3-g8w6-mf28.md)
  `GHSA-x3m3-g8w6-mf28`, `CVE-2022-27201` · Maven `org.jenkins-ci.plugins:semantic-versioning-plugin`: affected `<1.14`, fixed in `1.14` · CVSS 7.1 High · Not analysed yet · Published 16 Mar 2022 · Tags: XML external entities (XXE), Server-side request forgery (SSRF)
- [Improper Restriction of XML External Entity Reference in trytond and proteus](https://agentprime.io/advisories/GHSA-cj78-rgw3-4h5p.md)
  `GHSA-cj78-rgw3-4h5p`, `CVE-2022-26661`, `PYSEC-2022-43170`, `PYSEC-2026-3391`, `PYSEC-2026-740` · PyPI `proteus` and 1 more: affected `>=5.0.0, <5.0.12 || >=6.0.0, <6.0.5 || >=6.1.0, <6.2.2`, fixed in `5.0.12`, `6.0.5`, `6.2.2` · CVSS 6.5 Medium · Not analysed yet · Published 11 Mar 2022 · Tags: XML external entities (XXE)
- [Signiant - Manager+Agents XML External Entity (XXE)](https://agentprime.io/advisories/CVE-2022-22795.md)
  `CVE-2022-22795` · CVE record: Signiant Signiant · CVSS 6.8 Medium · Not analysed yet · Published 9 Mar 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Any23](https://agentprime.io/advisories/GHSA-2rmm-87v7-34rj.md)
  `GHSA-2rmm-87v7-34rj`, `CVE-2022-25312` · Maven `org.apache.any23:apache-any23`: affected `<2.7`, fixed in `2.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Liquibase](https://agentprime.io/advisories/GHSA-jvfv-hrrc-6q72.md)
  `GHSA-jvfv-hrrc-6q72`, `CVE-2022-0839` · Maven `org.liquibase:liquibase-core`: affected `<4.8.0`, fixed in `4.8.0` · CVSS 7.3 High · Not analysed yet · Published 5 Mar 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Hazelcast](https://agentprime.io/advisories/GHSA-99wh-973f-779p.md)
  `GHSA-99wh-973f-779p`, `CVE-2022-0265` · Maven `com.hazelcast:hazelcast`: affected `>=5.1-beta1, <5.1`, fixed in `5.1` · CVSS 7.3 High · Not analysed yet · Published 4 Mar 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer](https://agentprime.io/advisories/GHSA-xvm2-9xvc-hx7f.md)
  `GHSA-xvm2-9xvc-hx7f`, `CVE-2022-23640` · Maven `com.monitorjbl:xlsx-streamer`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Mar 2022 · Tags: XML external entities (XXE), Denial of service
- [IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611](https://agentprime.io/advisories/CVE-2020-14478.md)
  `CVE-2020-14478` · CVE record: Rockwell Automation FactoryTalk Services Platform · CVSS 7.1 High · Not analysed yet · Published 24 Feb 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra](https://agentprime.io/advisories/GHSA-38w8-h222-wrpp.md)
  `GHSA-38w8-h222-wrpp`, `CVE-2022-25209` · Maven `org.jenkins-ci.plugins:sinatra-chef-builder`: affected `<=1.20`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 16 Feb 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Magnolia CMS](https://agentprime.io/advisories/GHSA-3qpg-33wr-533j.md)
  `GHSA-3qpg-33wr-533j`, `CVE-2021-46365` · Maven `info.magnolia:magnolia-core`: affected `<6.2.4`, fixed in `6.2.4` · CVSS 7.8 High · Not analysed yet · Published 12 Feb 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-88cc-g835-76rp.md)
  `GHSA-88cc-g835-76rp`, `BIT-postgresql-jdbc-driver-2020-13692`, `CVE-2020-13692` · Maven `org.postgresql:postgresql`: affected `>=9.4.1212.jre6, <42.2.13`, fixed in `42.2.13` · CVSS 7.7 High · Not analysed yet · Published 10 Feb 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Intel(R) Quartus(R) Prime Pro Edition](https://agentprime.io/advisories/CVE-2022-21220.md)
  `CVE-2022-21220` · CVE record: Intel(R) Quartus(R) Prime Pro Edition · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Intel(R) Quartus(R) Prime Pro Edition](https://agentprime.io/advisories/CVE-2022-21205.md)
  `CVE-2022-21205` · CVE record: Intel(R) Quartus(R) Prime Pro Edition · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in BIG-IP FPS, ASM, and Advanced WAF](https://agentprime.io/advisories/CVE-2022-23031.md)
  `CVE-2022-23031` · CVE record: BIG-IP FPS, ASM, and Advanced WAF · No CVSS score · Not analysed yet · Published 25 Jan 2022 · Tags: XML external entities (XXE)
- [corenlp is vulnerable to Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-75vw-3m5v-fprh.md)
  `GHSA-75vw-3m5v-fprh`, `CVE-2022-0239` · Maven `edu.stanford.nlp:stanford-corenlp`: affected `<4.4.0`, fixed in `4.4.0` · CVSS 4.7 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in skylot/jadx](https://agentprime.io/advisories/GHSA-r8j4-96mx-rjcc.md)
  `GHSA-r8j4-96mx-rjcc`, `CVE-2022-0219` · Maven `io.github.skylot:jadx-core`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 5.5 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: XML external entities (XXE)
- [XML external entity injection in Oracle Corporation Java SE JDK and JRE](https://agentprime.io/advisories/CVE-2022-21282.md)
  `CVE-2022-21282` · CVE record: Oracle Corporation Java SE JDK and JRE · CVSS 5.3 Medium · Not analysed yet · Published 19 Jan 2022 · Tags: XML external entities (XXE)
- [XML External Entity Reference in edu.stanford.nlp:stanford-corenlp](https://agentprime.io/advisories/GHSA-mh83-jcw5-rjh8.md)
  `GHSA-mh83-jcw5-rjh8`, `CVE-2022-0198` · Maven `edu.stanford.nlp:stanford-corenlp`: affected `<=4.3.2`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 14 Jan 2022 · Tags: XML external entities (XXE)
- [AEM Forms Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2021-40722.md)
  `CVE-2021-40722` · CVE record: Adobe Experience Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Apache NiFi](https://agentprime.io/advisories/GHSA-q4xf-3pmq-3hw8.md)
  `GHSA-q4xf-3pmq-3hw8`, `BIT-nifi-2020-13940`, `CVE-2020-13940` · Maven `org.apache.nifi:nifi`: affected `>=1.0.0, <1.12.0-RC1`, fixed in `1.12.0-RC1` · CVSS 5.5 Medium · Not analysed yet · Published 6 Jan 2022 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in com.h2database:h2.](https://agentprime.io/advisories/GHSA-7rpj-hg47-cx62.md)
  `GHSA-7rpj-hg47-cx62`, `CVE-2021-23463`, `SNYK-JAVA-COMH2DATABASE-1769238` · Maven `com.h2database:h2`: affected `>=1.4.198, <2.0.202`, fixed in `2.0.202` · CVSS 8.1 High · Not analysed yet · Published 16 Dec 2021 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in dbeaver/dbeaver](https://agentprime.io/advisories/CVE-2021-3836.md)
  `CVE-2021-3836` · CVE record: dbeaver dbeaver/dbeaver · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2021 · Tags: XML external entities (XXE)
- [XML External Entity vulnerability in MODX CMS](https://agentprime.io/advisories/GHSA-vhfp-9wvj-gwvg.md)
  `GHSA-vhfp-9wvj-gwvg`, `BIT-modx-2020-25911`, `CVE-2020-25911`, `PKSA-bqwv-kpq3-qmj9` · Packagist `modx/revolution`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2021 · Tags: XML external entities (XXE)
- [XML External Entity Reference in org.opencms:opencms-core](https://agentprime.io/advisories/GHSA-g6v7-vqhx-6v6c.md)
  `GHSA-g6v7-vqhx-6v6c`, `CVE-2021-3312` · Maven `org.opencms:opencms-core`: affected `>=11.0.0, <12.0.0`, fixed in `12.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2021 · Tags: XML external entities (XXE)
- [XML external entity injection in SAP SE SAP BusinessObjects Business Intelligence Platform (Crystal Reports)](https://agentprime.io/advisories/CVE-2021-40500.md)
  `CVE-2021-40500` · CVE record: SAP SE SAP BusinessObjects Business Intelligence Platform (Crystal Reports) · No CVSS score · Not analysed yet · Published 12 Oct 2021 · Tags: XML external entities (XXE)
- [Billion Laughs](https://agentprime.io/advisories/CVE-2021-40439.md)
  `CVE-2021-40439` · CVE record: Apache Software Foundation Apache OpenOffice · No CVSS score · Not analysed yet · Published 7 Oct 2021 · Tags: XML external entities (XXE)
- [Cisco Identity Services Engine XML External Entity Injection Vulnerability](https://agentprime.io/advisories/CVE-2021-34706.md)
  `CVE-2021-34706` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 6.4 Medium · Not analysed yet · Published 6 Oct 2021 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby](https://agentprime.io/advisories/GHSA-2rr5-8q37-2w7h.md)
  `GHSA-2rr5-8q37-2w7h`, `CVE-2021-41098` · RubyGems `nokogiri`: affected `<1.12.5`, fixed in `1.12.5` · CVSS 7.5 High · Not analysed yet · Published 27 Sept 2021 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Apache Jena](https://agentprime.io/advisories/GHSA-7rp6-w7mg-h8rw.md)
  `GHSA-7rp6-w7mg-h8rw`, `CVE-2021-39239` · Maven `org.apache.jena:jena-core`: affected `<4.2.0`, fixed in `4.2.0` · No CVSS score · Not analysed yet · Published 20 Sept 2021 · Tags: XML external entities (XXE)
- [XML external entity injection in Siemens Teamcenter V12.4 and others](https://agentprime.io/advisories/CVE-2021-40356.md)
  `CVE-2021-40356` · CVE record: Siemens Teamcenter V12.4 and 3 more · No CVSS score · Not analysed yet · Published 14 Sept 2021 · Tags: XML external entities (XXE)
- [XML Injection in Any23](https://agentprime.io/advisories/GHSA-838r-hvwh-24h8.md)
  `GHSA-838r-hvwh-24h8`, `CVE-2021-38555` · Maven `org.apache.any23:apache-any23`: affected `<2.5`, fixed in `2.5` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2021 · Tags: XML external entities (XXE)
- [PAN-OS: XML External Entity (XXE) Reference Vulnerability in the PAN-OS Web Interface](https://agentprime.io/advisories/CVE-2021-3055.md)
  `CVE-2021-3055` · CVE record: Palo Alto Networks PAN-OS · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2021 · Tags: XML external entities (XXE)
- [XML external entity injection in The Eclipse Foundation Eclipse Theia](https://agentprime.io/advisories/CVE-2021-34436.md)
  `CVE-2021-34436` · CVE record: The Eclipse Foundation Eclipse Theia · No CVSS score · Not analysed yet · Published 2 Sept 2021 · Tags: Path traversal, XML external entities (XXE)
- [XML External Entity Injection in PyWPS](https://agentprime.io/advisories/GHSA-p9wf-3xpg-c9g5.md)
  `GHSA-p9wf-3xpg-c9g5`, `CVE-2021-39371`, `PYSEC-2021-121` · PyPI `pywps`: affected `<4.5.0`, fixed in `4.5.0` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2021 · Tags: Other injection, XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Quokka](https://agentprime.io/advisories/GHSA-4q2r-qxp6-h5j6.md)
  `GHSA-4q2r-qxp6-h5j6`, `CVE-2020-18705`, `PYSEC-2021-145` · PyPI `quokka`: affected `<=0.4.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Aug 2021 · Tags: XML external entities (XXE)
- [Improper Restriction of XML External Entity Reference in Quokka](https://agentprime.io/advisories/GHSA-3xg5-6c3j-vp8x.md)
  `GHSA-3xg5-6c3j-vp8x`, `CVE-2020-18703`, `PYSEC-2021-144` · PyPI `quokka`: affected `<=0.4.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Aug 2021 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDIxLTA4LTMwVDE2OjIzOjM0LjAwMDAwMFoiLCJHSFNBLTN4ZzUtNmMzai12cDh4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDIyLTA1LTEzVDAxOjA2OjEwLjAwMDAwMFoiLCJHSFNBLTM0d2otcDVqbS0ycDk2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDIyLTA1LTEzVDAxOjA2OjEwLjAwMDAwMFoiLCJHSFNBLTM0d2otcDVqbS0ycDk2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.