CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,349 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 22 of 27
- CVE-2018-3600MEDIUMCVSS 6.5EG 6.52018-02-09
A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.
- CVE-2017-14699MEDIUMCVSS 6.5EG 6.52018-01-29
Multiple XML external entity (XXE) vulnerabilities in the AiCloud feature on ASUS DSL-AC51, DSL-AC52U, DSL-AC55U, DSL-N55U C1, DSL-N55U D1, DSL-AC56U, DSL-N10_C1, DSL-N12U C1, DSL-N12E C1, DSL-N14U, DSL-N14U-B1, DSL-N16, DSL-N16U, DSL-N17U…
- CVE-2016-0219MEDIUMCVSS 6.5EG 6.52018-01-16
XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial o…
- CVE-2017-15639MEDIUMCVSS 6.5EG 6.52017-10-19
tasks/feed/readRSS.cfm in Mura CMS before 6.2 allows attackers to bypass intended access restrictions by leveraging the "draggable feeds" feature.
- CVE-2017-12623MEDIUMCVSS 6.5EG 6.52017-10-10
An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. …
- CVE-2017-8040MEDIUMCVSS 6.5EG 6.52017-09-09
In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, an XXE (XML External Entity) attack was discovered in the Single Sign-On service dashboard. Privileged users can in some cas…
- CVE-2015-0194MEDIUMCVSS 6.5EG 6.52017-08-02
XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data.
- CVE-2017-11457MEDIUMCVSS 6.5EG 6.52017-07-25
XML external entity (XXE) vulnerability in com.sap.km.cm.ice in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request, …
- CVE-2017-1219MEDIUMCVSS 6.5EG 6.52017-07-19
IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force…
- CVE-2017-0170MEDIUMCVSS 6.5EG 6.52017-07-11
Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vul…
- CVE-2016-0254MEDIUMCVSS 6.5EG 6.52017-06-07
IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consu…
- CVE-2017-2308MEDIUMCVSS 6.5EG 6.52017-05-30
An XML External Entity Injection vulnerability in Juniper Networks Junos Space versions prior to 16.1R1 may allow an authenticated user to read arbitrary files on the device.
- CVE-2017-9295MEDIUMCVSS 6.5EG 6.52017-05-29
XXE vulnerability in Hitachi Device Manager before 8.5.2-01 and Hitachi Replication Manager before 8.5.2-00 allows authenticated remote users to read arbitrary files.
- CVE-2016-4931MEDIUMCVSS 6.5EG 6.52017-03-20
XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.
- CVE-2017-3811MEDIUMCVSS 6.5EG 6.52017-03-17
An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc39165. Known Affected Re…
- CVE-2016-3027MEDIUMCVSS 6.5EG 6.52017-02-01
IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive inform…
- CVE-2015-7743MEDIUMCVSS 6.5EG 6.52017-01-23
XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file.
- CVE-2012-3489MEDIUMCVSS 6.5EG 6.52012-10-03
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary…
- CVE-2012-0037MEDIUMCVSS 6.5EG 6.52012-06-17
Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML exter…
- CVE-2021-43990MEDIUMCVSS 6.1EG 6.52022-04-20
The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.
- CVE-2018-5434MEDIUMCVSS 5.8EG 6.52018-06-13
The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host mac…
- CVE-2021-1483MEDIUMCVSS 6.4EG 6.42024-11-15
A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper han…
- CVE-2021-34706MEDIUMCVSS 6.4EG 6.42021-10-06
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an a…
- CVE-2021-21266MEDIUMCVSS 6.4EG 6.42021-02-01
openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to ret…
- CVE-2018-17152MEDIUMCVSS 6.4EG 6.42019-07-11
Intersystems Cache 2017.2.2.865.0 allows XXE.
- CVE-2026-16999MEDIUMCVSS 6.3EG 6.32026-08-12
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
- CVE-2026-12788MEDIUMCVSS 6.3EG 6.32026-06-21
A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /adpweb/a/base/barcodeDetail/import of the co…
- CVE-2026-4980MEDIUMCVSS 6.3EG 6.32026-03-27
A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.
- CVE-2026-2536MEDIUMCVSS 6.3EG 6.32026-02-16
A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File c…
- CVE-2026-2074MEDIUMCVSS 6.3EG 6.32026-02-07
A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It…
- CVE-2026-1218MEDIUMCVSS 6.3EG 6.32026-01-20
A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichClientService. Performing a manipulation results in xml extern…
- CVE-2025-13209MEDIUMCVSS 6.3EG 6.32025-11-15
A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation…
- CVE-2025-3241MEDIUMCVSS 6.3EG 6.32025-04-04
A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of t…
- CVE-2025-2365MEDIUMCVSS 6.3EG 6.32025-03-17
A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity referenc…
- CVE-2025-1225MEDIUMCVSS 6.3EG 6.32025-02-12
A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interf…
- CVE-2024-49535MEDIUMCVSS 6.3EG 6.32024-12-10
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide mali…
- CVE-2024-8602MEDIUMCVSS 6.3EG 6.32024-10-14
When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Op…
- CVE-2024-3930MEDIUMCVSS 6.3EG 6.32024-07-30
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.
- CVE-2023-49234MEDIUMCVSS 6.3EG 6.32024-03-29
An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.
- CVE-2024-2826MEDIUMCVSS 6.3EG 6.32024-03-22
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The a…
- CVE-2023-30951MEDIUMCVSS 6.3EG 6.32023-08-03
The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).
- CVE-2023-27554MEDIUMCVSS 6.3EG 6.32023-05-11
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory res…
- CVE-2018-25082MEDIUMCVSS 6.3EG 6.32023-03-21
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgradi…
- CVE-2021-23418MEDIUMCVSS 6.3EG 6.32021-07-29
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
- CVE-2017-18438MEDIUMCVSS 6.3EG 6.32019-08-02
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
- CVE-2020-37192MEDIUMCVSS 6.2EG 6.22026-02-11
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that…
- CVE-2025-61823MEDIUMCVSS 6.2EG 6.22025-12-10
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit…
- CVE-2026-73235MEDIUMCVSS 6.1EG 6.12026-08-11
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCS…
- CVE-2025-47778MEDIUMCVSS 6.1EG 6.12025-05-14
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for …
- CVE-2022-27193MEDIUMCVSS 6.1EG 6.12022-03-15
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the syst…
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →