XML external entities (XXE).

pam_usb: xmlReadFile flags=0 permits XXE network entity fetching in conf.c

• mcdope pam_usb
• XML external entities (XXE)

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

• XML external entities (XXE)

<6.9.10 · fixed in 6.9.10

GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution

• XML external entities (XXE)
• Server-side request forgery (SSRF)

<2.26.4 || >=2.27.0, <2.27.3 · fixed in 2.26.4, 2.27.3

Apache CXF has Improper Restriction of XML External Entity Reference

• XML external entities (XXE)

>=4.2.0, <4.2.2 || >=4.0.0, <4.1.7 || <3.6.12 · fixed in 4.2.2, 4.1.7, 3.6.12

Spring Web Services: Jaxp13 XPath XXE via StreamSource and SAXSource

• XML external entities (XXE)

>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

• XML external entities (XXE)

>=4.0.0, <4.0.1 || >=3.0.0, <3.0.6 || <=2.0.8.RELEASE · fixed in 4.0.1, 3.0.6

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• XML external entities (XXE)

XML external entity injection in Schneider Electric EcoStruxure™ IT Data Center Expert

• Schneider Electric EcoStruxure™ IT Data Center Expert
• XML external entities (XXE)

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

• XML external entities (XXE)
• Denial of service

>=2.13.0, <2.74.0 · fixed in 2.74.0

Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

• XML external entities (XXE)
• Denial of service

>=2.45.0, <2.91.0 · fixed in 2.91.0

XML external entity injection in JetBrains IntelliJ IDEA

• JetBrains IntelliJ IDEA
• XML external entities (XXE)

Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

• XML external entities (XXE)

<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12

Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference

• Hitachi Vantara Pentaho Data Integration and Analytics
• XML external entities (XXE)

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack

• IBM Engineering Lifecycle Management
• XML external entities (XXE)

Apache CXF's WS-Transfer module has an insecure XML parser configuration

• XML external entities (XXE)

>=4.2.0, <4.2.1 || >=4.1.0, <4.1.6 || <3.6.11 · fixed in 4.2.1, 4.1.6, 3.6.11

TYPO3 ke_search XML External Entity Injection

• XML external entities (XXE)

<4.6.7 || >=5.0.0, <5.6.2 || >=6.0.0, <6.6.1 || >=7.0.0, <7.0.1 · fixed in 4.6.7, 5.6.2, 6.6.1, 7.0.1

Oinone Pamirs 7.0.0 contains an XML External Entity (XXE) issue in its XStream-based XML parsing logic.

• XML external entities (XXE)

ERPNext: XML External Entity (XEE) Reference Vulnerability in the EDI Module

• frappe erpnext
• XML external entities (XXE)

SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser

• anzory SolidCAM-GPPL-IDE
• Denial of service
• XML external entities (XXE)

fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

• Other injection
• XML external entities (XXE)

<1.1.7 · fixed in 1.1.7

Alkacon OpenCms allows remote unauthenticated attackers to obtain sensitive information

• XML external entities (XXE)

<10.5.1 · fixed in 10.5.1

Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host

• XML external entities (XXE)

<16.0 · fixed in 16.0

Vvveb < 1.0.8.2 XML External Entity Injection via Import

• givanz Vvveb
• XML external entities (XXE)

Grav is Vulnerable to XXE via SVG Upload

• XML external entities (XXE)

<2.0.0-beta.2 · fixed in 2.0.0-beta.2

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.

• XML external entities (XXE)

changedetection.io project has an XXE vulnerability

• XML external entities (XXE)

<=0.54.9 · no fixed version yet

Apache OpenNLP DictionaryEntryPersistor Vulnerable to XML External Entity (XXE) via Unsanitized Dictionary Parsing

• XML external entities (XXE)

>=2.0.0, <2.5.9 || >=3.0.0-M1, <3.0.0-M3 || <1.9.5 · fixed in 2.5.9, 3.0.0-M3, 1.9.5

jOpenDocument has an improper restriction of XML external entity reference vulnerability

• XML external entities (XXE)

<=1.3 · no fixed version yet

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.

• RTI Connext Professional
• XML external entities (XXE)

Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro

• Lobster GmbH Lobster_pro
• XML external entities (XXE)

Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP

• 4D Server
• XML external entities (XXE)

An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.

• XML external entities (XXE)

NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

• NSA GRASSMARLIN
• XML external entities (XXE)

lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files

• XML external entities (XXE)

<6.1.0 · fixed in 6.1.0

Information disclosure in Oracle Corporation Oracle Java SE and others

• Oracle Corporation Oracle Java SE
• Oracle Corporation Oracle GraalVM for JDK
• Information disclosure
• Insecure deserialization

XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files

• WSO2 API Manager
• XML external entities (XXE)

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

• WSO2 API Manager
• WSO2 Identity Server
• XML external entities (XXE)

OpenRemote has XXE in Velbus Asset Import

• XML external entities (XXE)

<1.22.0 · fixed in 1.22.0

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

• Denial of service
• XML external entities (XXE)

>=8.0.0, <8.0.3 || >=9.0.0, <9.0.15 || >=10.0.0, <10.0.6 · fixed in 8.0.3, 9.0.15, 10.0.6

Chamilo LMS has an XML External Entity (XXE) Injection

• chamilo-lms
• XML external entities (XXE)

Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Recording Service,Routing Service,Queueing Service,Cloud Discovery Service,Observability Collector) al…

• RTI Connext Professional
• XML external entities (XXE)

XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading

• microsoft XmlNotepad
• XML external entities (XXE)

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

• XML external entities (XXE)

Improper Restriction of XML External Entity Reference in Inkscape

• Inkscape
• XML external entities (XXE)

OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files

• openemr
• XML external entities (XXE)

XXE in esaml SAML library allows local file read and potential SSRF

• XML external entities (XXE)

* · no fixed version yet

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.

• XML external entities (XXE)

XML external entity injection in Slovensko.Digital Autogram

• Slovensko.Digital Autogram
• XML external entities (XXE)

Tolgee has an XXE Injection in Translation Import

• tolgee-platform
• XML external entities (XXE)

IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability

• IBM InfoSphere Information Server
• XML external entities (XXE)

thinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference

• thinkgem JeeSite
• XML external entities (XXE)
• CWE-610

XML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)

• Xerox FreeFlow Core
• XML external entities (XXE)
• Server-side request forgery (SSRF)

IBM Db2 XML External Entity Reference

• IBM Db2 for Linux, UNIX and Windows
• XML external entities (XXE)

opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference

• opencc JFlow
• XML external entities (XXE)
• CWE-610

MSN Password Recovery 1.30 - XML External Entity Injection

• Top Password Software MSN Password Recovery
• XML external entities (XXE)

XML external entity injection in Schneider Electric EcoStruxure Building Operation Workstation and others

• Schneider Electric EcoStruxure Building Operation Workstation
• Schneider Electric EcoStruxure Building Operation Webstation
• XML external entities (XXE)

O2OA HTTP POST Request check xml external entity reference

• O2OA
• XML external entities (XXE)
• CWE-610

Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection

• asterisk
• XML external entities (XXE)

Apache Syncope: Console XXE on Keymaster parameters

• XML external entities (XXE)

>=3.0.0, <3.0.16 || >=4.0.0, <4.0.4 · fixed in 3.0.16, 4.0.4

XML external entity injection in Atlassian Crowd Data Center

• Atlassian Crowd Data Center
• XML external entities (XXE)