Advisories · Weakness
XML external entities (XXE).
XML parsers made to read files or reach other hosts. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.2 High
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
- XML external entities (XXE)
>=1.4.0, <3.27.7 · fixed in 3.27.7
GHSA-rqfh-9r24-8c9r · CVE-2026-24400 - CVSS 9.8 CriticalCritical · CVSS 9+
XDocReport affected by an XML External Entity (XXE) vulnerability
- XML external entities (XXE)
>=0.9.2, <2.0.4 · fixed in 2.0.4
GHSA-7jc7-g598-2p64 · CVE-2025-65482 - CVSS 5.3 Medium
Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference
- Bjskzy Zhiyou ERP
- XML external entities (XXE)
- CWE-610
- CVSS 7.5 High
Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
- kraftplugins Demo Importer Plus
- XML external entities (XXE)
- CVSS 8.7 High
Geonetwork 4.2.0 - XML External Entity (XXE)
- GeoNetwork
- XML external entities (XXE)
- CVSS 8.1 HighCritical · CVSS 7+ and EPSS
Apache Struts 2 is Missing XML Validation
- XML external entities (XXE)
- CWE-112
>=2.0.0 · no fixed version yet
GHSA-qcfc-hmrc-59x7 · CVE-2025-68493 - CVSS 4.6 Medium
Bio-Formats has an XML External Entity (XXE) vulnerability
- XML external entities (XXE)
<=8.3.0 · no fixed version yet
GHSA-fcqj-76g3-q7qm · CVE-2026-22186 - CVSS 4.9 Medium
Cisco Identity Services Engine XML External Entity Processing Information Disclosure Vulnerability
- Cisco Identity Services Engine Software
- XML external entities (XXE)
- CVSS 7.6 High
XML external entity injection in Dell Unisphere for PowerMax
- Dell Unisphere for PowerMax
- XML external entities (XXE)
- CVSS 6.5 Medium
Apache SIS has Improper Restriction of XML External Entity Reference vulnerability
- XML external entities (XXE)
>=0.4, <1.6 · fixed in 1.6
GHSA-jqmr-2pg9-vfx7 · CVE-2025-68280 - CVSS 6.3 Medium
beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference
- beecue FastBee
- XML external entities (XXE)
- CWE-610
- CVSS 7.1 High
KYOCERA Net Admin 3.4.0906 Unauthenticated XML External Entity Injection
- KYOCERA Corporation KYOCERA Net Admin
- XML external entities (XXE)
- CVSS 7.1 High
NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection
- NovaRad Corporation NovaPACS Diagnostics Viewer
- XML external entities (XXE)
- CVSS 5.0 Medium
XML external entity injection in jcthiele OpenXRechnungToolbox
- jcthiele OpenXRechnungToolbox
- XML external entities (XXE)
- CVSS 4.9 Medium
Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
- XML external entities (XXE)
<=1.86 · no fixed version yet
GHSA-x3vf-39hj-gxr4 · CVE-2025-68463 - CVSS 7.4 High
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 6.8 Medium
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 6.2 Medium
ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
- CVSS 8.4 HighCritical · CVSS 7+ and EPSS
Apache Tika has XXE vulnerability
- XML external entities (XXE)
>=1.13, <3.2.2 · fixed in 3.2.2
GHSA-f58c-gq56-vjjf · CVE-2025-66516 - CVSS 9.1 CriticalCritical · CVSS 9+
XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.
- XML external entities (XXE)
- CVSS 2.8 Low
Mustangproject allows exfiltrating files via XXE attacks
- XML external entities (XXE)
<2.16.3 · fixed in 2.16.3
GHSA-x832-fpvj-r5ph · CVE-2025-66372 - CVSS 5.0 Medium
Peppol-py is vulnerable to XXE attacks due to Saxon configuration
- XML external entities (XXE)
<1.1.1 · fixed in 1.1.1
GHSA-24hm-wm2h-h8w7 · CVE-2025-66371 - CVSS 5.0 Medium
XML external entity injection in kivitendo
- kivitendo
- XML external entities (XXE)
- CVSS 8.2 HighCritical · KEV, CVSS 7+ and EPSSKEV
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
- XML external entities (XXE)
>=2.26.0, <2.26.2 || <2.25.6 · fixed in 2.26.2, 2.25.6
GHSA-fjf5-xgmq-5525 · CVE-2025-58360 - CVSS 7.1 High
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references.
- XML external entities (XXE)
- CVSS 5.3 Medium
bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference
- bestfeng oa_git_free
- XML external entities (XXE)
- CWE-610
- CVSS 8.4 HighCritical · CVSS 7+ and EPSS
N-central Multiple XXE Injection Vulnerabilities
- N-able N-central
- XML external entities (XXE)
- CVSS 7.5 High
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
- XML external entities (XXE)
>=2.1.0, <11.0.1 · fixed in 11.0.1
GHSA-6fhj-vr9j-g45r · CVE-2025-64518 - CVSS 7.5 High
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1.
- XML external entities (XXE)
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks
- XML external entities (XXE)
* · no fixed version yet
GHSA-fvfq-q238-j7j3 · CVE-2025-10713 - CVSS 7.1 High
IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability
- IBM InfoSphere Information Server
- XML external entities (XXE)
- CVSS 7.1 High
Jenkins JDepend Plugin vulnerable to XML external entity attacks
- XML external entities (XXE)
<=1.3.1 · no fixed version yet
GHSA-jfg6-4gx3-3v7w · CVE-2025-64134 - CVSS 6.5 Medium
XML external entity injection in Dell Storage Manager
- Dell Storage Manager
- XML external entities (XXE)
- CVSS 7.5 High
LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing
- XML external entities (XXE)
<0.3.9 · fixed in 0.3.9
GHSA-m42m-m8cr-8m58 · CVE-2025-6985 - CVSS 6.9 Medium
Jinher OA type xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 8.8 High
XML external entity injection in Saison Technology Co.,Ltd. DataSpider Servista
- Saison Technology Co.,Ltd. DataSpider Servista
- XML external entities (XXE)
- CVSS 6.9 Medium
Bjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity reference
- Bjskzy Zhiyou ERP
- XML external entities (XXE)
- CWE-610
- CVSS 5.3 Medium
Jinher OA text xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 6.9 Medium
Jinher OA XML text xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 9.1 CriticalCritical · CVSS 9+
XML External Entity Injection in TecConnect 4.1
- TecCom TecConnect
- XML external entities (XXE)
- CVSS 6.9 Medium
Jinher OA XML Type xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 6.9 Medium
Jinher OA XML Type xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610
- CVSS 7.5 High
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
- Information disclosure
- XML external entities (XXE)
<0.3.27 · fixed in 0.3.27
GHSA-pc6w-59fv-rh23 · CVE-2025-6984 - CVSS 8.7 High
Sangfor Behavior Management System XML External Entity Injection
- Sangfor Technologies Co. Ltd. Sangfor Behavior Management System (DC Management System)
- XML external entities (XXE)
- CVSS 5.1 Medium
Agiloft XML external entity local path traversal
- Agiloft
- XML external entities (XXE)
- CVSS 5.5 Medium
EIP Builder XML External Entity Processing Information Disclosure Vulnerability
- Delta Electronics EIP Builder
- XML external entities (XXE)
- CVSS 8.4 HighCritical · CVSS 7+ and EPSS
Apache Tika XXE Vulnerability via Crafted XFA File Inside a PDF
- XML external entities (XXE)
>=1.13, <3.2.2 · fixed in 3.2.2
GHSA-p72g-pv48-7w9x · CVE-2025-54988 - CVSS 8.2 High
XML External Entity Injection vulnerability in various Lexmark Universal Drivers
- Lexmark Universal Print Driver
- Lexmark Printer Software G2
- XML external entities (XXE)
- CVSS 5.5 Medium
XML external entity injection in Dell CloudLink
- Dell CloudLink
- XML external entities (XXE)
- CVSS 6.8 Medium
XML external entity injection in Siemens SIMOTION SCOUT TIA V5.4 and others
- Siemens SIMOTION SCOUT TIA V5.4
- Siemens SIMOTION SCOUT TIA V5.5
- XML external entities (XXE)
- CVSS 6.9 Medium
OpenKilda XXE in SAML configuration
- telstra open-kilda
- XML external entities (XXE)
- CVSS 7.5 High
XXE leading to SSRF
- Xerox FreeFlow Core
- XML external entities (XXE)
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe Experience Manager
- XML external entities (XXE)
- CVSS 6.5 Medium
XML external entity injection in Dell SmartFabric OS10 Software
- Dell SmartFabric OS10 Software
- XML external entities (XXE)
- CVSS 5.3 Medium
SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability
- SolarWinds Web Help Desk
- XML external entities (XXE)
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
XML external entity injection in Samsung Electronics MagicINFO 9 Server
- Samsung Electronics MagicINFO 9 Server
- XML external entities (XXE)
- CVSS 8.6 High
Lantronix Provisioning Manager Improper Restriction of XML External Entity Reference
- Lantronix Provisioning Manager
- XML external entities (XXE)
- CVSS 6.9 Medium
ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler
- ETQ Reliance CG (legacy)
- XML external entities (XXE)
- CVSS 4.2 Medium
XML external entity injection in Dell AppSync
- Dell AppSync
- XML external entities (XXE)
- CVSS 6.9 Medium
Jinher OA XmlHttp.aspx xml external entity reference
- Jinher OA
- XML external entities (XXE)
- CWE-610