CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,345 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 15 of 27

CVE-2020-6590HIGHCVSS 7.5EG 7.5
2021-04-08
Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure.
CVE-2021-29421HIGHCVSS 7.5EG 7.5
2021-04-01
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
CVE-2021-28110HIGHCVSS 7.5EG 7.5
2021-03-19
/exec in TranzWare e-Commerce Payment Gateway (TWEC PG) before 3.1.27.5 had a vulnerability in its XML parser.
CVE-2021-27184HIGHCVSS 7.5EG 7.5
2021-02-11
Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), resulting in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB…
CVE-2020-25649HIGHCVSS 7.5EG 7.5
2020-12-03
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-2324HIGHCVSS 7.5EG 7.5
2020-12-03
Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-24454HIGHCVSS 7.5EG 7.5
2020-11-12
Improper Restriction of XML External Entity Reference in subsystem forIntel(R) Quartus(R) Prime Pro Edition before version 20.3 and Intel(R) Quartus(R) Prime Standard Edition before version 20.2 may allow unauthenticated user to potentiall…
CVE-2020-25186HIGHCVSS 7.5EG 7.5
2020-10-22
An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, which may allow file disclosure.
CVE-2020-4643HIGHCVSS 7.5EG 7.5
2020-09-21
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information. IBM X-Forc…
CVE-2020-14029HIGHCVSS 7.5EG 7.5
2020-09-18
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary l…
CVE-2020-25750HIGHCVSS 7.5EG 7.5
2020-09-18
An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string with…
CVE-2020-15418HIGHCVSS 7.5EG 7.5
2020-07-28
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRS…
CVE-2020-5602HIGHCVSS 7.5EG 7.5
2020-06-30
Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT20…
CVE-2020-14940HIGHCVSS 7.5EG 7.5
2020-06-23
An issue was discovered in io/gpx/GPXDocumentReader.java in TuxGuitar 1.5.4. It uses misconfigured XML parsers, leading to XXE while loading GP6 (.gpx) and GP7 (.gp) tablature files.
CVE-2020-2012HIGHCVSS 7.5EG 7.5
2020-05-13
Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrar…
CVE-2020-12642HIGHCVSS 7.5EG 7.5
2020-05-04
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
CVE-2020-10629HIGHCVSS 7.5EG 7.5
2020-04-09
WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files.
CVE-2019-20191HIGHCVSS 7.5EG 7.5
2020-03-16
Oxygen XML Editor 21.1.1 allows XXE to read any file.
CVE-2020-9044HIGHCVSS 7.5EG 7.5
2020-03-10
XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite…
CVE-2015-1811HIGHCVSS 7.5EG 7.5
2020-01-15
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.
CVE-2015-1809HIGHCVSS 7.5EG 7.5
2020-01-15
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
CVE-2019-18412HIGHCVSS 7.5EG 7.5
2020-01-15
JetBrains IDETalk plugin before version 193.4099.10 allows XXE
CVE-2019-19998HIGHCVSS 7.5EG 7.5
2019-12-26
Xiuno BBS 4.0 allows XXE via plugin/xn_wechat_public/route/token.php.
CVE-2012-2656HIGHCVSS 7.5EG 7.5
2019-12-18
An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.
CVE-2014-3643HIGHCVSS 7.5EG 7.5
2019-12-15
jersey: XXE via parameter entities not disabled by the jersey SAX parser
CVE-2019-19702HIGHCVSS 7.5EG 7.5
2019-12-10
The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this to perform a denial of service against the DMARC reporting functionali…
CVE-2011-3600HIGHCVSS 7.5EG 7.5
2019-11-26
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it c…
CVE-2019-10172HIGHCVSS 7.5EG 7.5
2019-11-18
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
CVE-2019-18227HIGHCVSS 7.5EG 7.5
2019-10-31
Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilities exist that may allow disclosure of sensitive data.
CVE-2017-15725HIGHCVSS 7.5EG 7.5
2019-10-28
An XML External Entity Injection vulnerability exists in Dzone AnswerHub.
CVE-2019-8087HIGHCVSS 7.5EG 7.5
2019-10-25
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-8086HIGHCVSS 7.5EG 7.5
2019-10-25
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-8082HIGHCVSS 7.5EG 7.5
2019-10-25
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a xml external entity injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2019-6179HIGHCVSS 7.5EG 7.5
2019-09-03
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity I…
CVE-2019-14258HIGHCVSS 7.5EG 7.5
2019-08-21
The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.
CVE-2019-13176HIGHCVSS 7.5EG 7.5
2019-08-08
An issue was discovered in the 3CX Phone system (web) management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SS…
CVE-2018-14383HIGHCVSS 7.5EG 7.5
2019-08-07
The Transition Technologies "The Scheduler" app 5.1.3 for Jira allows XXE due to a weakly configured/parameterized XML parser. It was fixed in the versions 5.2.1 and 3.3.7
CVE-2019-10266HIGHCVSS 7.5EG 7.5
2019-07-26
An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.
CVE-2019-7847HIGHCVSS 7.5EG 7.5
2019-07-18
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the con…
CVE-2019-13358HIGHCVSS 7.5EG 7.5
2019-07-05
lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. The attacker must upload a file in the docx or odt format.
CVE-2019-9843HIGHCVSS 7.5EG 7.5
2019-06-28
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, t…
CVE-2018-20843HIGHCVSS 7.5EG 7.5
2019-06-24
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service att…
CVE-2019-11392HIGHCVSS 7.5EG 7.5
2019-06-21
BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
CVE-2019-10718HIGHCVSS 7.5EG 7.5
2019-06-21
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
CVE-2019-10337HIGHCVSS 7.5EG 7.5
2019-06-11
An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the ex…
CVE-2019-3722HIGHCVSS 7.5EG 7.5
2019-06-06
Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to …
CVE-2019-0188HIGHCVSS 7.5EG 7.5
2019-05-28
Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
CVE-2019-8999HIGHCVSS 7.5EG 7.5
2019-04-18
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
CVE-2019-10244HIGHCVSS 7.5EG 7.5
2019-04-09
In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service (not part of the device distribution) could potentially be target of XXE attack due to an …
CVE-2019-9761HIGHCVSS 7.5EG 7.5
2019-03-14
An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.p…

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →