Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
Jinher OA ProjectScheduleDelete.aspx xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 6.5 Medium
agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint.
- XML external entities (XXE)
- CVSS 6.9 Medium
DSpace is vulnerable to XML External Entity injection during archive imports
- XML external entities (XXE)
<7.6.4 || >=8.0, <8.2 || >=9.0, <9.1 · fixed in 7.6.4, 8.2, 9.1
GHSA-jjwr-5cfh-7xwh · CVE-2025-53621 - CVSS 8.8 High
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
- XML external entities (XXE)
>=2.23.0-beta, <2.23.2-beta || >=2.20.0, <2.20.17 || >=2.22.0, <2.22.1 · fixed in 2.23.2-beta, 2.20.17, 2.22.1
GHSA-44c3-38h8-9fh9 · CVE-2025-53689 - CVSS 6.9 Medium
Jinher OA DelTemp.aspx xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 5.9 Medium
XML external entity injection in Schneider Electric EcoStruxure™ IT Data Center Expert
- Schneider Electric EcoStruxure™ IT Data Center Expert
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · CVSS 9+
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 4.5 Medium
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 6.8 Medium
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 5.8 Medium
XML external entity injection in Akamai CloudTest
- Akamai CloudTest
- XML external entities (XXE)
- CVSS 7.5 High
Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
- XML external entities (XXE)
<2.34.1 · fixed in 2.34.1
GHSA-h7qf-qmf3-85qg · CVE-2025-52888 - CVSS 7.1 High
IBM QRadar SIEM XML external entity injection
- IBM QRadar SIEM
- XML external entities (XXE)
- CVSS 2.7 Low
PowSyBl Core XML Reader allows XXE and SSRF
- XML external entities (XXE)
- Server-side request forgery (SSRF)
<6.7.2 · fixed in 6.7.2
GHSA-qpj9-qcwx-8jv2 · CVE-2025-47293 - CVSS 8.8 High
IBM webMethods Integration Sever XML external entity injection
- IBM webMethods Integration Server
- XML external entities (XXE)
- CVSS 8.2 High
GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
- XML external entities (XXE)
- Server-side request forgery (SSRF)
>=4.4.0, <4.4.8 || >=4.2.0, <4.2.13 · fixed in 4.4.8, 4.2.13
GHSA-2p76-gc46-5fvc - CVSS 9.9 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
- XML external entities (XXE)
- Server-side request forgery (SSRF)
>=2.27.0, <2.27.1 || >=2.26.0, <2.26.3 || <2.25.7 · fixed in 2.27.1, 2.26.3, 2.25.7
GHSA-jj54-8f66-c5pc · CVE-2025-30220 - CVSS 9.3 CriticalCritical · CVSS 9+
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
- Information disclosure
- XML external entities (XXE)
<2.25.0 · fixed in 2.25.0
GHSA-mc43-4fqr-c965 · CVE-2024-34711 - CVSS 7.5 High
Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE).
- XML external entities (XXE)
- CVSS 9.9 CriticalCritical · CVSS 9+
GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling
- XML external entities (XXE)
>=33.0, <33.1 || >=32.0, <32.3 || >=29.0, <31.7 || <28.6.1 · fixed in 33.1, 32.3, 31.7, 28.6.1
GHSA-826p-4gcg-35vw - CVSS 9.1 CriticalCritical · CVSS 9+
WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability
- pixelgrade Category Icon
- XML external entities (XXE)
- CVSS 5.3 Medium
Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference
- Fengoffice Feng Office
- XML external entities (XXE)
- CWE-610
- CVSS 8.7 High
PHPOffice Math allows XXE when processing an XML file in the MathML format
- XML external entities (XXE)
<0.3.0 · fixed in 0.3.0
GHSA-42hm-pq2f-3r7m · CVE-2025-48882 - CVSS 6.9 Medium
Lantronix Device Installer Improper Restriction of XML External Entity Reference
- Lantronix Device Installer
- XML external entities (XXE)
- CVSS 6.8 Medium
Eclipse JGit XML External Entity (XXE) Vulnerability
- XML external entities (XXE)
>=7.2.0.202503040940-r, <7.2.1.202505142326-r || >=7.1.0.202411261347-r, <7.1.1.202505221757-r || >=7.0.0.202409031743-r, <7.0.1.202505221510-r || >=6.1.0.202203080745-r, <6.10.1.202505221210-r || >=6.0.0.202110060947-m1, <6.0.0.202111291000-r || <5.13.4.202507202350-r · fixed in 7.2.1.202505142326-r, 7.1.1.202505221757-r, 7.0.1.202505221510-r, 6.10.1.202505221210-r, 6.0.0.202111291000-r, 5.13.4.202507202350-r
GHSA-vrpq-qp53-qv56 · CVE-2025-4949 - CVSS 6.1 Medium
Sulu vulnerable to XXE in SVG File upload Inspector
- XML external entities (XXE)
>=2.5.21, <2.5.25 || >=2.6.5, <2.6.9 || >=3.0.0-alpha1, <3.0.0-alpha3 · fixed in 2.5.25, 2.6.9, 3.0.0-alpha3
GHSA-f6rx-hf55-4255 · CVE-2025-47778 - CVSS 8.7 High
XXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager
- Hitachi JP1/IT Desktop Management 2 - Smart Device Manager
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · CVSS 9+
BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference
- XML external entities (XXE)
>=1.0.0, <6.1.0 · fixed in 6.1.0
GHSA-pwm3-776c-8q7q · CVE-2025-4641 - CVSS 8.8 High
Improper Restriction of XML External Entity Reference in Peergos
- Peergos
- XML external entities (XXE)
- CVSS 7.1 High
XML external entity injection in Siemens Polarion V2310 and others
- Siemens Polarion V2310
- Siemens Polarion V2404
- XML external entities (XXE)
- CVSS 8.6 High
Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
- SAP_SE SAP Supplier Relationship Management (Live Auction Cockpit)
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity Injection
- SysAid On-Prem
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
- SysAid On-Prem
- XML external entities (XXE)
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
- SysAid On-Prem
- XML external entities (XXE)
- CVSS 8.1 High
XML external entity injection in Dell Storage Center - Dell Storage Manager
- Dell Storage Center - Dell Storage Manager
- XML external entities (XXE)
- CVSS 7.8 High
Langroid Allows XXE Injection via XMLToolMessage
- XML external entities (XXE)
<0.53.4 · fixed in 0.53.4
GHSA-pw95-88fg-3j6f · CVE-2025-46726 - CVSS 9.1 CriticalCritical · CVSS 9+
WSO2 API Manager XML External Entity (XXE) vulnerability
- XML external entities (XXE)
<2.1.0 · fixed in 2.1.0
GHSA-h94w-8qhg-3xmc · CVE-2025-2905 - CVSS 6.5 Medium
GFI MailEssentials < 21.8 XXE Arbitrary File Read
- GFI MailEssentials
- XML external entities (XXE)
- CVSS 5.1 Medium
XML external entity injection in FileZ Client
- FileZ Client
- XML external entities (XXE)
- CVSS 4.9 Medium
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- XML external entities (XXE)
- CVSS 4.9 Medium
Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference
- Hitachi Vantara Pentaho Business Analytics Server
- XML external entities (XXE)
- CVSS 7.5 High
TEIGarage XML External Entity (XXE) Injection in Document Conversion Service
- TEIC TEIGarage
- XML external entities (XXE)
- CVSS 4.0, no score published
ibexa/fieldtype-richtext allows access to external entities in XML
- XML external entities (XXE)
>=4.6.0-beta1, <4.6.19 · fixed in 4.6.19
GHSA-cj3w-g42v-wcj6 - CVSS 4.0, no score published
ezsystems/ezplatform-richtext allows access to external entities in XML
- XML external entities (XXE)
>=2.3.0-beta1, <2.3.26 · fixed in 2.3.26
GHSA-2jqj-5qv2-xvcg - CVSS 8.6 High
XML external entity injection in NAKIVO Backup & Replication Director
- NAKIVO Backup & Replication Director
- XML external entities (XXE)
- CVSS 6.6 Medium
WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability
- supsystic Easy Google Maps
- XML external entities (XXE)
- CVSS 7.7 High
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
- XML external entities (XXE)
>=4.2, <8.5.6 · fixed in 8.5.6
GHSA-wc53-4255-gw3f · CVE-2025-31487 - CVSS 5.3 Medium
zhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference
- zhangyanbo2007 youkefu
- XML external entities (XXE)
- CWE-610
- CVSS 8.4 High
XML external entity injection in W3C CSS Validator
- W3C CSS Validator
- XML external entities (XXE)
- CVSS 4.1 Medium
XML external entity injection in JetBrains GoLand
- JetBrains GoLand
- XML external entities (XXE)
- CVSS 6.8 Medium
Jalios JPlatform 10 Authenticated XML External Entity Injection (XXE)
- Jalios JPlatform
- XML external entities (XXE)
- CVSS 5.3 Medium
crmeb_java WeChatMessageController.java webHook xml external entity reference
- crmeb_java
- XML external entities (XXE)
- CWE-610
- CVSS 4.0, no score published
LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-47qw-ccjm-9c2c - CVSS 4.0, no score published
LocalS3 Project Vulnerable to XML External Entity (XXE) Injection via Bucket Tagging API
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-v232-254c-m6p7 - CVSS 4.0, no score published
LocalS3 Project Bucket Operations Vulnerable to XML External Entity (XXE) Injection
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-2466-4485-4pxj - CVSS 5.5 Medium
LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
- XML external entities (XXE)
<1.21 · fixed in 1.21
GHSA-g6wm-2v64-wq36 · CVE-2025-27136 - CVSS 7.1 High
IBM Aspera Shares XML external entity injection
- IBM Aspera Shares
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Lucee RCE/XXE Vulnerability
- XML external entities (XXE)
>=5.3.10.79-RC, <5.3.12.1 || >=5.4.0.65-RC, <5.4.3.2 || <=5.3.7.59 || >=5.3.8.132-RC, <5.3.8.236 || >=5.3.9.113, <5.3.9.173 · fixed in 5.3.12.1, 5.4.3.2, 5.3.8.236, 5.3.9.173
GHSA-vwjx-mmwm-pwrf · CVE-2023-38693 - CVSS 6.9 Medium
Keysight Ixia Vision Product Family Improper Restriction of XML External Entity Reference
- Keysight Ixia Vision Product Family
- XML external entities (XXE)
- CVSS 7.1 High
IBM OpenPages XML external entity injection
- IBM OpenPages with Watson
- XML external entities (XXE)
- CVSS 8.2 High
IBM Cognos Controller XML external entity injection
- IBM Cognos Controller
- IBM Controller
- XML external entities (XXE)