CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,349 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 23 of 27

CVE-2019-18943MEDIUMCVSS 6.1EG 6.1
2021-02-26
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
CVE-2023-20030MEDIUMCVSS 6.0EG 6.0
2023-04-05
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an aff…
CVE-2019-0284MEDIUMCVSS 6.0EG 6.0
2019-04-10
SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE…
CVE-2026-18061MEDIUMCVSS 5.9EG 5.9
2026-09-11
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files fro…
CVE-2026-19596MEDIUMCVSS 5.9EG 5.9
2026-09-10
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored…
CVE-2026-40991MEDIUMCVSS 5.9EG 5.9
2026-06-10
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attac…
CVE-2026-46722MEDIUMCVSS 5.9EG 5.9
2026-05-19
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieve…
CVE-2024-56356MEDIUMCVSS 5.9EG 5.9
2024-12-20
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVE-2024-6961MEDIUMCVSS 5.9EG 5.9
2024-07-21
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal fil…
CVE-2024-31139MEDIUMCVSS 5.9EG 5.9
2024-03-28
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
CVE-2023-28828MEDIUMCVSS 5.9EG 5.9
2023-04-11
A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
CVE-2023-23926MEDIUMCVSS 5.9EG 5.9
2023-02-16
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph d…
CVE-2019-8997MEDIUMCVSS 5.9EG 5.9
2019-03-21
An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or m…
CVE-2018-17247MEDIUMCVSS 5.9EG 5.9
2018-12-20
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could …
CVE-2016-6805MEDIUMCVSS 5.9EG 5.9
2017-04-07
Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
CVE-2017-6344MEDIUMCVSS 5.9EG 5.9
2017-02-27
XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document.
CVE-2025-49493MEDIUMCVSS 5.8EG 5.8
2025-06-30
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
CVE-2024-28039MEDIUMCVSS 5.8EG 5.8
2024-03-18
Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.
CVE-2022-43473MEDIUMCVSS 5.8EG 5.8
2023-03-30
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this v…
CVE-2016-7458MEDIUMCVSS 5.8EG 5.8
2016-12-29
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related …
CVE-2019-6194MEDIUMCVSS 5.7EG 5.7
2020-02-14
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure.
CVE-2018-0414MEDIUMCVSS 5.7EG 5.7
2018-10-05
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML …
CVE-2025-15251MEDIUMCVSS 5.6EG 5.6
2025-12-30
A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Messa…
CVE-2023-3892MEDIUMCVSS 5.6EG 5.6
2023-09-19
Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an a…
CVE-2020-14379MEDIUMCVSS 5.6EG 5.6
2022-08-16
A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
CVE-2026-82525MEDIUMCVSS 5.5EG 5.5
2026-09-03
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XS…
CVE-2026-82918MEDIUMCVSS 5.5EG 5.5
2026-09-03
XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionT…
CVE-2026-75058MEDIUMCVSS 5.5EG 5.5
2026-08-17
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
CVE-2026-75055MEDIUMCVSS 5.5EG 5.5
2026-08-17
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
CVE-2026-14304MEDIUMCVSS 5.5EG 5.5
2026-08-05
In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulne…
CVE-2025-36374MEDIUMCVSS 5.5EG 5.5
2026-07-30
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE-2026-6807MEDIUMCVSS 5.5EG 5.5
2026-04-28
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing…
CVE-2025-57704MEDIUMCVSS 5.5EG 5.5
2025-08-26
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability.
CVE-2025-26484MEDIUMCVSS 5.5EG 5.5
2025-08-14
Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of s…
CVE-2025-40584MEDIUMCVSS 5.5EG 5.5
2025-08-12
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION S…
CVE-2025-27136MEDIUMCVSS 5.5EG 5.5
2025-03-10
LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfigurati…
CVE-2018-9379MEDIUMCVSS 5.5EG 5.5
2025-01-17
In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User in…
CVE-2024-12298MEDIUMCVSS 5.5EG 5.5
2025-01-14
We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer.
CVE-2024-49704MEDIUMCVSS 5.5EG 5.5
2024-12-10
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All vers…
CVE-2024-20531MEDIUMCVSS 5.5EG 5.5
2024-11-06
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affec…
CVE-2024-45086MEDIUMCVSS 5.5EG 5.5
2024-11-04
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory reso…
CVE-2024-45072MEDIUMCVSS 5.5EG 5.5
2024-10-16
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory reso…
CVE-2024-25971MEDIUMCVSS 5.5EG 5.5
2024-03-28
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.
CVE-2023-25926MEDIUMCVSS 5.5EG 5.5
2024-02-29
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive inf…
CVE-2024-1167MEDIUMCVSS 5.5EG 5.5
2024-02-01
When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.
CVE-2024-22380MEDIUMCVSS 5.5EG 5.5
2024-01-24
Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity ref…
CVE-2024-21796MEDIUMCVSS 5.5EG 5.5
2024-01-24
Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). …
CVE-2024-21765MEDIUMCVSS 5.5EG 5.5
2024-01-24
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Su…
CVE-2023-5136MEDIUMCVSS 5.5EG 5.5
2023-11-08
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
CVE-2023-46802MEDIUMCVSS 5.5EG 5.5
2023-11-06
e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read b…

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →