# XML external entities (XXE).

XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [XML external entity injection in FUJI ELECTRIC CO., LTD. FRENIC RHC Loader](https://agentprime.io/advisories/CVE-2023-29498.md)
  `CVE-2023-29498` · CVE record: FUJI ELECTRIC CO., LTD. FRENIC RHC Loader · CVSS 5.5 Medium · Not analysed yet · Published 13 Jun 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in ArcSight Logger](https://agentprime.io/advisories/CVE-2023-24470.md)
  `CVE-2023-24470` · CVE record: ArcSight Logger · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jun 2023 · Tags: XML external entities (XXE)
- [xml-rs vulnerable to denial of service via invalid token in XML document](https://agentprime.io/advisories/GHSA-7gf7-jv65-wjmh.md)
  `GHSA-7gf7-jv65-wjmh`, `CVE-2023-34411` · crates.io `xml-rs`: affected `>=0.8.9, <0.8.14`, fixed in `0.8.14` · CVSS 7.5 High · Not analysed yet · Published 5 Jun 2023 · Tags: XML external entities (XXE), Denial of service
- [Denial Of Service due to Untrusted XML Tag in XML Parser within SAML Authentication](https://agentprime.io/advisories/CVE-2023-32706.md)
  `CVE-2023-32706` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.7 High · Not analysed yet · Published 1 Jun 2023 · Tags: XML external entities (XXE)
- [The client in OpenText Archive Center Administration through 21.2 allows XXE attacks.](https://agentprime.io/advisories/CVE-2022-41221.md)
  `CVE-2022-41221` · CVE record · CVSS 7.1 High · Not analysed yet · Published 24 May 2023 · Tags: XML external entities (XXE)
- [Weaver e-cology API RequestInfoByXml xml external entity reference](https://agentprime.io/advisories/CVE-2023-2806.md)
  `CVE-2023-2806` · CVE record: Weaver e-cology · CVSS 5.5 Medium · Not analysed yet · Published 19 May 2023 · Tags: XML external entities (XXE)
- [Cisco Identity Services Engine XML External Entity Injection Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20174.md)
  `CVE-2023-20174` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 4.9 Medium · Not analysed yet · Published 18 May 2023 · Tags: XML external entities (XXE)
- [Cisco Identity Services Engine XML External Entity Injection Vulnerabilities](https://agentprime.io/advisories/CVE-2023-20173.md)
  `CVE-2023-20173` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 4.9 Medium · Not analysed yet · Published 18 May 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in Schneider Electric OPC Factory Server (OFS)](https://agentprime.io/advisories/CVE-2023-2161.md)
  `CVE-2023-2161` · CVE record: Schneider Electric OPC Factory Server (OFS) · CVSS 5.0 Medium · Not analysed yet · Published 16 May 2023 · Tags: XML external entities (XXE)
- [IBM WebSphere Application Server XML external entity injection](https://agentprime.io/advisories/CVE-2023-27554.md)
  `CVE-2023-27554` · CVE record: IBM WebSphere Application Server · CVSS 6.3 Medium · Not analysed yet · Published 11 May 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in The Ministry of Justice Shinseiyo Sogo Soft](https://agentprime.io/advisories/CVE-2023-27527.md)
  `CVE-2023-27527` · CVE record: The Ministry of Justice Shinseiyo Sogo Soft · CVSS 2.5 Low · Not analysed yet · Published 10 May 2023 · Tags: XML external entities (XXE)
- [CVE-2022-45876](https://agentprime.io/advisories/CVE-2022-45876.md)
  `CVE-2022-45876` · CVE record: VISAM VBASE · CVSS 5.5 Medium · Not analysed yet · Published 26 Apr 2023 · Tags: XML external entities (XXE)
- [Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a…](https://agentprime.io/advisories/CVE-2023-29443.md)
  `CVE-2023-29443` · CVE record · CVSS 4.9 Medium · Not analysed yet · Published 26 Apr 2023 · Tags: XML external entities (XXE)
- [An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page.](https://agentprime.io/advisories/CVE-2023-26058.md)
  `CVE-2023-26058` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: XML external entities (XXE)
- [An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page.](https://agentprime.io/advisories/CVE-2023-26057.md)
  `CVE-2023-26057` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 25 Apr 2023 · Tags: XML external entities (XXE)
- [An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the \_default\_.xml file.](https://agentprime.io/advisories/CVE-2023-27652.md)
  `CVE-2023-27652` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 20 Apr 2023 · Tags: XML external entities (XXE)
- [cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.](https://agentprime.io/advisories/CVE-2022-38840.md)
  `CVE-2022-38840` · CVE record · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2023 · Tags: XML external entities (XXE)
- [All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code.](https://agentprime.io/advisories/CVE-2023-26264.md)
  `CVE-2023-26264` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 13 Apr 2023 · Tags: XML external entities (XXE)
- [All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server.](https://agentprime.io/advisories/CVE-2023-26263.md)
  `CVE-2023-26263` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 13 Apr 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in Siemens Polarion ALM](https://agentprime.io/advisories/CVE-2023-28828.md)
  `CVE-2023-28828` · CVE record: Siemens Polarion ALM · CVSS 5.9 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: XML external entities (XXE)
- [Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.](https://agentprime.io/advisories/CVE-2023-28340.md)
  `CVE-2023-28340` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in Ministry of Land, Infrastructure, Transport and Tourism…](https://agentprime.io/advisories/CVE-2023-25955.md)
  `CVE-2023-25955` · CVE record: Ministry of Land, Infrastructure, Transport and Tourism, Japan National land numerical information data conversion tool · CVSS 5.5 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: XML external entities (XXE)
- [IBM TRIRIGA Application Platform XML external entity injection](https://agentprime.io/advisories/CVE-2023-27876.md)
  `CVE-2023-27876` · CVE record: IBM TRIRIGA Application Platform · CVSS 7.1 High · Not analysed yet · Published 7 Apr 2023 · Tags: XML external entities (XXE)
- [Cisco Identity Services Engine XML External Entity Injection Vulnerability](https://agentprime.io/advisories/CVE-2023-20030.md)
  `CVE-2023-20030` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 6.0 Medium · Not analysed yet · Published 5 Apr 2023 · Tags: XML external entities (XXE)
- [Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2022-43941.md)
  `CVE-2022-43941` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 7.1 High · Not analysed yet · Published 3 Apr 2023 · Tags: XML external entities (XXE)
- [Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks](https://agentprime.io/advisories/GHSA-vq5h-qgxm-2m39.md)
  `GHSA-vq5h-qgxm-2m39`, `CVE-2023-28680` · Maven `org.jenkins-ci.plugins:crap4j`: affected `<=0.9`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 2 Apr 2023 · Tags: XML external entities (XXE)
- [Jenkins Visual Studio Code Metrics Plugin vulnerable to XML external entity (XXE) attacks](https://agentprime.io/advisories/GHSA-8j88-2hfc-5rf3.md)
  `GHSA-8j88-2hfc-5rf3`, `CVE-2023-28681` · Maven `org.jenkins-ci.plugins:vs-code-metrics`: affected `<=1.7`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 2 Apr 2023 · Tags: XML external entities (XXE)
- [Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks](https://agentprime.io/advisories/GHSA-w4g6-8xqp-g92m.md)
  `GHSA-w4g6-8xqp-g92m`, `CVE-2023-28683` · Maven `org.jenkins-ci.plugins:phabricator-plugin`: affected `<=2.1.5`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 2 Apr 2023 · Tags: XML external entities (XXE)
- [Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks](https://agentprime.io/advisories/GHSA-qgm7-m77f-j8pf.md)
  `GHSA-qgm7-m77f-j8pf`, `CVE-2023-28682` · Maven `org.jenkins-ci.plugins:perfpublisher`: affected `<=8.09`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 2 Apr 2023 · Tags: XML external entities (XXE)
- [Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks](https://agentprime.io/advisories/GHSA-58ch-c2jf-5g23.md)
  `GHSA-58ch-c2jf-5g23`, `CVE-2023-28684` · Maven `com.sap.jenkinsci:remote-jobs-view-plugin`: affected `<=0.0.3`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 2 Apr 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in ManageEngine OpManager](https://agentprime.io/advisories/CVE-2022-43473.md)
  `CVE-2022-43473` · CVE record: ManageEngine OpManager · CVSS 5.8 Medium · EPSS 0.20 · Not analysed yet · Published 30 Mar 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in AVEVA Edge](https://agentprime.io/advisories/CVE-2022-36969.md)
  `CVE-2022-36969` · CVE record: AVEVA Edge · CVSS 5.5 Medium · EPSS 0.14 · Not analysed yet · Published 29 Mar 2023 · Tags: XML external entities (XXE)
- [An issue was discovered in Independentsoft JWord before 1.1.110.](https://agentprime.io/advisories/CVE-2023-28152.md)
  `CVE-2023-28152` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2023 · Tags: XML external entities (XXE)
- [An issue was discovered in Independentsoft JSpreadsheet before 1.1.110.](https://agentprime.io/advisories/CVE-2023-28151.md)
  `CVE-2023-28151` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2023 · Tags: XML external entities (XXE)
- [An issue was discovered in Independentsoft JODF before 1.1.110.](https://agentprime.io/advisories/CVE-2023-28150.md)
  `CVE-2023-28150` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Mar 2023 · Tags: XML external entities (XXE)
- [CVE-2022-45468](https://agentprime.io/advisories/CVE-2022-45468.md)
  `CVE-2022-45468` · CVE record: VISAM VBASE · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2023 · Tags: XML external entities (XXE)
- [CVE-2022-45121](https://agentprime.io/advisories/CVE-2022-45121.md)
  `CVE-2022-45121` · CVE record: VISAM VBASE · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2023 · Tags: XML external entities (XXE)
- [CVE-2022-41696](https://agentprime.io/advisories/CVE-2022-41696.md)
  `CVE-2022-41696` · CVE record: VISAM VBASE · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2023 · Tags: XML external entities (XXE)
- [CVE-2022-43512](https://agentprime.io/advisories/CVE-2022-43512.md)
  `CVE-2022-43512` · CVE record: VISAM VBASE · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2023 · Tags: XML external entities (XXE)
- [CVE-2022-46300](https://agentprime.io/advisories/CVE-2022-46300.md)
  `CVE-2022-46300` · CVE record: VISAM VBASE · CVSS 5.5 Medium · Not analysed yet · Published 21 Mar 2023 · Tags: XML external entities (XXE)
- [IBM Aspera Faspex XML external entity injection](https://agentprime.io/advisories/CVE-2023-27874.md)
  `CVE-2023-27874` · CVE record: IBM Aspera Faspex · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Mar 2023 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)](https://agentprime.io/advisories/CVE-2023-26461.md)
  `CVE-2023-26461` · CVE record: SAP NetWeaver (SAP Enterprise Portal) · CVSS 6.8 Medium · Not analysed yet · Published 14 Mar 2023 · Tags: XML external entities (XXE)
- [ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability](https://agentprime.io/advisories/CVE-2023-1288.md)
  `CVE-2023-1288` · CVE record: Dassault Systèmes ENOVIA Live Collaboration · CVSS 6.8 Medium · Not analysed yet · Published 9 Mar 2023 · Tags: XML external entities (XXE)
- [XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/GHSA-gx4f-976g-7g6v.md)
  `GHSA-gx4f-976g-7g6v`, `CVE-2023-27480` · Maven `org.xwiki.platform:xwiki-platform-xar-model`: affected `>=1.1-milestone-3, <13.10.11 || >=14.0, <14.4.7 || >=14.5, <14.10-rc-1`, fixed in `13.10.11`, `14.4.7`, `14.10-rc-1` · CVSS 7.7 High · Not analysed yet · Published 8 Mar 2023 · Tags: XML external entities (XXE)
- [OWSLib vulnerable to XML External Entity (XXE) Injection](https://agentprime.io/advisories/GHSA-8h9c-r582-mggc.md)
  `GHSA-8h9c-r582-mggc`, `CVE-2023-27476`, `PYSEC-2023-86` · PyPI `owslib`: affected `<0.28.1`, fixed in `0.28.1` · CVSS 8.2 High · Not analysed yet · Published 7 Mar 2023 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in apoc.import.graphml](https://agentprime.io/advisories/GHSA-9vx8-f5c4-862x.md)
  `GHSA-9vx8-f5c4-862x` · Maven `org.neo4j.procedure:apoc`: affected `<4.4.0.14 || >=5.0.0, <5.5.0`, fixed in `4.4.0.14`, `5.5.0` · CVSS 5.9 Medium · Not analysed yet · Published 24 Feb 2023 · Tags: XML external entities (XXE)
- [An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.](https://agentprime.io/advisories/CVE-2023-24189.md)
  `CVE-2023-24189` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2023 · Tags: XML external entities (XXE)
- [UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference](https://agentprime.io/advisories/CVE-2015-10082.md)
  `CVE-2015-10082` · CVE record: UIKit0 libplist · CVSS 5.5 Medium · Not analysed yet · Published 21 Feb 2023 · Tags: XML external entities (XXE)
- [php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.](https://agentprime.io/advisories/CVE-2023-26267.md)
  `CVE-2023-26267` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 21 Feb 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in VMware vRealize Orchestrator, VMware vRealize Automation…](https://agentprime.io/advisories/CVE-2023-20855.md)
  `CVE-2023-20855` · CVE record: VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud Foundation · CVSS 8.8 High · Not analysed yet · Published 21 Feb 2023 · Tags: XML external entities (XXE)
- [dd-plist XML External Entitly vulnerability](https://agentprime.io/advisories/GHSA-4jx2-hvqw-93j9.md)
  `GHSA-4jx2-hvqw-93j9`, `CVE-2016-15026` · Maven `com.googlecode.plist:dd-plist`: affected `<1.18`, fixed in `1.18` · CVSS 5.3 Medium · Not analysed yet · Published 20 Feb 2023 · Tags: XML external entities (XXE)
- [java-xmlbuilder vulnerable to XML External Entity Reference](https://agentprime.io/advisories/GHSA-3vrc-rrpw-r5pw.md)
  `GHSA-3vrc-rrpw-r5pw`, `CVE-2014-125087` · Maven `com.jamesmurty.utils:java-xmlbuilder`: affected `<1.2`, fixed in `1.2` · CVSS 5.5 Medium · Not analysed yet · Published 19 Feb 2023 · Tags: XML external entities (XXE)
- [An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.](https://agentprime.io/advisories/CVE-2021-33950.md)
  `CVE-2021-33950` · CVE record · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2023 · Tags: XML external entities (XXE)
- [XML External Entity (XXE) vulnerability in apoc.import.graphml](https://agentprime.io/advisories/GHSA-6wxg-wh7f-rqpr.md)
  `GHSA-6wxg-wh7f-rqpr`, `CVE-2023-23926` · Maven `org.neo4j.procedure:apoc-core`: affected `>=5.0.0, <5.5.0 || <4.4.0.14`, fixed in `5.5.0`, `4.4.0.14` · CVSS 5.9 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in Fortinet FortiNAC](https://agentprime.io/advisories/CVE-2022-39954.md)
  `CVE-2022-39954` · CVE record: Fortinet FortiNAC · CVSS 6.9 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in Cisco Secure Endpoint](https://agentprime.io/advisories/CVE-2023-20052.md)
  `CVE-2023-20052` · CVE record: Cisco Cisco Secure Endpoint · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: XML external entities (XXE)
- [XML external entity injection in FUJITSU LIMITED tsClinical Define.xml Generator and tsClinical Metadata Desktop…](https://agentprime.io/advisories/CVE-2023-22377.md)
  `CVE-2023-22377` · CVE record: FUJITSU LIMITED tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools · CVSS 7.4 High · Not analysed yet · Published 15 Feb 2023 · Tags: XML external entities (XXE)
- [XML External Entity Reference in ureport](https://agentprime.io/advisories/GHSA-fhj6-gr87-g4cj.md)
  `GHSA-fhj6-gr87-g4cj`, `CVE-2023-24187` · Maven `com.bstek.ureport:ureport2-core`: affected `<=2.2.9`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 14 Feb 2023 · Tags: XML external entities (XXE)
- [XML External Entity Reference in Apache NiFi](https://agentprime.io/advisories/GHSA-hxjp-q6c3-38fx.md)
  `GHSA-hxjp-q6c3-38fx`, `BIT-nifi-2023-22832`, `CVE-2023-22832` · Maven `org.apache.nifi:nifi-ccda-processors`: affected `>=1.2.0, <1.20.0`, fixed in `1.20.0` · CVSS 7.5 High · Not analysed yet · Published 10 Feb 2023 · Tags: XML external entities (XXE)
- [Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.](https://agentprime.io/advisories/CVE-2023-24323.md)
  `CVE-2023-24323` · CVE record · CVSS 8.8 High · Not analysed yet · Published 9 Feb 2023 · Tags: XML external entities (XXE)

Newest: <https://agentprime.io/advisories/tag/xxe.md>
Older: <https://agentprime.io/advisories/tag/xxe.md?cursor=WyIyMDIzLTAyLTA5VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNDMyMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=xxe&cursor=WyIyMDIzLTA2LTE1VDE1OjMwOjE1LjAwMDAwMFoiLCJHSFNBLXAycWYtOXZwNi0zampxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/xxe/?cursor=WyIyMDIzLTA2LTE1VDE1OjMwOjE1LjAwMDAwMFoiLCJHSFNBLXAycWYtOXZwNi0zampxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.