CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,345 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 13 of 27
- CVE-2026-17615HIGHCVSS 7.5EG 7.52026-08-31
A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external en…
- CVE-2026-82880HIGHCVSS 7.5EG 7.52026-08-31
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearch parsers that fail to disable external entity resolution. Attackers can publish malicious documents with DOCTYPE decla…
- CVE-2026-20320HIGHCVSS 7.5EG 7.52026-08-19
A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system. This vulnerability exists because XML e…
- CVE-2026-65432HIGHCVSS 7.5EG 7.52026-08-06
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not…
- CVE-2026-54366HIGHCVSS 7.5EG 7.52026-07-30
CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attacke…
- CVE-2026-50782HIGHCVSS 7.5EG 7.52026-07-29
Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbit…
- CVE-2026-8396HIGHCVSS 7.5EG 7.52026-07-17
Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2.
- CVE-2026-44020HIGHCVSS 7.5EG 7.52026-06-03
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection…
- CVE-2026-45071HIGHCVSS 7.5EG 7.52026-05-27
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling …
- CVE-2026-41895HIGHCVSS 7.5EG 7.52026-05-12
changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpath_filter() switches to XML mode for XML/RSS content and creates etree.XMLParser(strip_cdata=False) without explicitly disabling external en…
- CVE-2023-42346HIGHCVSS 7.5EG 7.52026-05-08
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
- CVE-2024-13971HIGHCVSS 7.5EG 7.52026-04-30
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform …
- CVE-2024-39847HIGHCVSS 7.5EG 7.52026-04-30
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GE…
- CVE-2026-41066HIGHCVSS 7.5EG 7.52026-04-24
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the res…
- CVE-2026-22016HIGHCVSS 7.5EG 7.52026-04-21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17…
- CVE-2024-2374HIGHCVSS 7.5EG 7.52026-04-16
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's …
- CVE-2026-26171HIGHCVSS 7.5EG 7.52026-04-14
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
- CVE-2026-1567HIGHCVSS 7.5EG 7.52026-03-03
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 An XML External Entity (XXE) vulnerability in IBM InfoSphere Information Server could allow attackers to retrieve sensitive information from the server.
- CVE-2026-2252HIGHCVSS 7.5EG 7.52026-02-27
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to an…
- CVE-2025-14478HIGHCVSS 7.5EG 7.52026-01-17
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Au…
- CVE-2019-25253HIGHCVSS 7.5EG 7.52025-12-24
KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with e…
- CVE-2025-11700HIGHCVSS 7.5EG 7.52025-11-12
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
- CVE-2025-64518HIGHCVSS 7.5EG 7.52025-11-10
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-c…
- CVE-2025-63551HIGHCVSS 7.5EG 7.52025-11-06
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows…
- CVE-2025-6985HIGHCVSS 7.5EG 7.52025-10-06
The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets…
- CVE-2025-8355HIGHCVSS 7.5EG 7.52025-08-08
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
- CVE-2025-52888HIGHCVSS 7.5EG 7.52025-06-24
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to secu…
- CVE-2025-44044HIGHCVSS 7.5EG 7.52025-06-10
Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operat…
- CVE-2025-31497HIGHCVSS 7.5EG 7.52025-04-15
TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity (XXE) Injection vulnerability in its doc…
- CVE-2025-23195HIGHCVSS 7.5EG 7.52025-01-21
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` clas…
- CVE-2024-46603HIGHCVSS 7.5EG 7.52025-01-07
An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.
- CVE-2024-46602HIGHCVSS 7.5EG 7.52025-01-07
An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to cause a Denial of Service (DoS) via a crafted XML payload.
- CVE-2023-24466HIGHCVSS 7.5EG 7.52024-11-22
Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.
- CVE-2024-48917HIGHCVSS 7.5EG 7.52024-11-18
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `f…
- CVE-2024-47873HIGHCVSS 7.5EG 7.52024-11-18
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` m…
- CVE-2024-28168HIGHCVSS 7.5EG 7.52024-10-09
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.
- CVE-2024-45293HIGHCVSS 7.5EG 7.52024-10-07
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces.…
- CVE-2024-46985HIGHCVSS 7.5EG 7.52024-09-23
DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to imple…
- CVE-2024-38374HIGHCVSS 7.5EG 7.52024-06-28
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverage…
- CVE-2021-47621HIGHCVSS 7.5EG 7.52024-06-21
ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
- CVE-2024-36827HIGHCVSS 7.5EG 7.52024-06-07
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
- CVE-2023-51591HIGHCVSS 7.5EG 7.52024-05-03
Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPow…
- CVE-2023-40507HIGHCVSS 7.5EG 7.52024-05-03
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…
- CVE-2023-40506HIGHCVSS 7.5EG 7.52024-05-03
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…
- CVE-2023-40503HIGHCVSS 7.5EG 7.52024-05-03
LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…
- CVE-2023-45139HIGHCVSS 7.5EG 7.52024-01-10
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), wh…
- CVE-2023-6280HIGHCVSS 7.5EG 7.52023-12-19
An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve f…
- CVE-2023-6836HIGHCVSS 7.5EG 7.52023-12-15
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
- CVE-2023-22274HIGHCVSS 7.5EG 7.52023-11-17
Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this i…
- CVE-2023-46590HIGHCVSS 7.5EG 7.52023-11-14
A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfer…
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →