CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,345 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 14 of 27

CVE-2023-38343HIGHCVSS 7.5EG 7.5
2023-09-21
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can le…
CVE-2023-40239HIGHCVSS 7.5EG 7.5
2023-09-01
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model …
CVE-2020-26710HIGHCVSS 7.5EG 7.5
2023-06-29
easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVE-2020-26709HIGHCVSS 7.5EG 7.5
2023-06-29
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVE-2020-26708HIGHCVSS 7.5EG 7.5
2023-06-29
requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
CVE-2023-34411HIGHCVSS 7.5EG 7.5
2023-06-05
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
CVE-2023-27527HIGHCVSS 7.5EG 7.5
2023-05-10
Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
CVE-2022-38840HIGHCVSS 7.5EG 7.5
2023-04-16
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.
CVE-2023-28680HIGHCVSS 7.5EG 7.5
2023-04-02
Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2021-33950HIGHCVSS 7.5EG 7.5
2023-02-17
An issue discovered in OpenKM v6.3.10 allows attackers to obtain sensitive information via the XMLTextExtractor function.
CVE-2023-22832HIGHCVSS 7.5EG 7.5
2023-02-10
The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that …
CVE-2023-22624HIGHCVSS 7.5EG 7.5
2023-01-17
Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks.
CVE-2023-23595HIGHCVSS 7.5EG 7.5
2023-01-15
BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, such as "machine example.com login daniel password qwerty" in the documentation example for the .net…
CVE-2022-42745HIGHCVSS 7.5EG 7.5
2022-11-03
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
CVE-2022-43430HIGHCVSS 7.5EG 7.5
2022-10-19
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43415HIGHCVSS 7.5EG 7.5
2022-10-19
Jenkins REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-40705HIGHCVSS 7.5EG 7.5
2022-09-22
An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown wh…
CVE-2022-37189HIGHCVSS 7.5EG 7.5
2022-09-07
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
CVE-2022-0217HIGHCVSS 7.5EG 7.5
2022-08-26
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity reference…
CVE-2020-21641HIGHCVSS 7.5EG 7.5
2022-08-15
Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote attackers to read arbitrary files, enumerate folders and scan internal ports via crafted XML license file.
CVE-2022-31471HIGHCVSS 7.5EG 7.5
2022-07-26
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the c…
CVE-2022-32458HIGHCVSS 7.5EG 7.5
2022-07-20
Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.
CVE-2022-35168HIGHCVSS 7.5EG 7.5
2022-07-12
Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.
CVE-2021-40510HIGHCVSS 7.5EG 7.5
2022-06-21
XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.
CVE-2022-32285HIGHCVSS 7.5EG 7.5
2022-06-14
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). T…
CVE-2022-31447HIGHCVSS 7.5EG 7.5
2022-06-14
An XML external entity (XXE) injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file.
CVE-2022-31261HIGHCVSS 7.5EG 7.5
2022-05-24
An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML identity provider to be configured. In order to exploit the vulnerability, the attacker must know the unique SAML callback …
CVE-2022-29801HIGHCVSS 7.5EG 7.5
2022-05-20
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to…
CVE-2021-27777HIGHCVSS 7.5EG 7.5
2022-05-12
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious…
CVE-2022-29265HIGHCVSS 7.5EG 7.5
2022-04-30
Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted X…
CVE-2021-44477HIGHCVSS 7.5EG 7.5
2022-03-25
GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of…
CVE-2022-21205HIGHCVSS 7.5EG 7.5
2022-02-09
Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an unauthenticated user to potentially enable information disclosure via network access.
CVE-2021-20838HIGHCVSS 7.5EG 7.5
2021-11-01
Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially cra…
CVE-2021-3869HIGHCVSS 7.5EG 7.5
2021-10-19
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
CVE-2020-19954HIGHCVSS 7.5EG 7.5
2021-10-14
An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.
CVE-2021-35496HIGHCVSS 7.5EG 7.5
2021-10-12
The XMLA Connections component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Ser…
CVE-2021-40500HIGHCVSS 7.5EG 7.5
2021-10-12
SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missing XML validations at endpoints to read sensitive data. These endpoints are normally exposed over …
CVE-2021-41770HIGHCVSS 7.5EG 7.5
2021-10-07
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.
CVE-2021-41098HIGHCVSS 7.5EG 7.5
2021-09-27
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who pa…
CVE-2021-39239HIGHCVSS 7.5EG 7.5
2021-09-16
A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
CVE-2021-40356HIGHCVSS 7.5EG 7.5
2021-09-14
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter V13.1 (All versions < V13.1.0.5), Teamcenter V13.2 (All versions < 13.2.0.2). The application conta…
CVE-2021-39371HIGHCVSS 7.5EG 7.5
2021-08-23
An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
CVE-2021-1630HIGHCVSS 7.5EG 7.5
2021-08-05
XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime Fabric, Pivotal Cloud Foundry, Private Cloud Edition, and on-premise customers.
CVE-2021-30201HIGHCVSS 7.5EG 7.5
2021-07-09
The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following …
CVE-2012-1102HIGHCVSS 7.5EG 7.5
2021-07-09
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depe…
CVE-2021-25951HIGHCVSS 7.5EG 7.5
2021-06-30
XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service.
CVE-2021-29620HIGHCVSS 7.5EG 7.5
2021-06-23
Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity (XXE) atta…
CVE-2021-33813HIGHCVSS 7.5EG 7.5
2021-06-16
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.
CVE-2021-22140HIGHCVSS 7.5EG 7.5
2021-05-13
Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawler beta feature. Using this vector, an attacker whose website is being crawled by App Search could c…
CVE-2021-30006HIGHCVSS 7.5EG 7.5
2021-05-11
In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →