CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,349 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 26 of 27
- CVE-2024-54005MEDIUMCVSS 5.1EG 5.12024-12-10
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All vers…
- CVE-2024-58335MEDIUMCVSS 5.0EG 5.02025-12-24
OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.
- CVE-2025-66371MEDIUMCVSS 5.0EG 5.02025-11-28
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
- CVE-2025-66370MEDIUMCVSS 5.0EG 5.02025-11-28
Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.
- CVE-2025-2070MEDIUMCVSS 5.0EG 5.02025-04-25
An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a local user.
- CVE-2024-45745MEDIUMCVSS 5.0EG 5.02024-09-27
TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access URLs (XXE). Fixed in 8.0.1 (bug fix: TBS-6721).
- CVE-2023-4218MEDIUMCVSS 5.0EG 5.02023-11-09
In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for rev…
- CVE-2023-2161MEDIUMCVSS 5.0EG 5.02023-05-16
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized read access to the file system when a malicious configuration file is loaded on to the software by a local user.
- CVE-2017-10617MEDIUMCVSS 5.0EG 5.02017-10-13
The ifmap service that comes bundled with Contrail has an XML External Entity (XXE) vulnerability that may allow an attacker to retrieve sensitive system files. Affected releases are Juniper Networks Contrail 2.2 prior to 2.21.4; 3.0 prior…
- CVE-2017-7457MEDIUMCVSS 5.0EG 5.02017-04-14
XML External Entity via ".AOP" files used by Moxa MX-AOPC Server 1.5 result in remote file disclosure.
- CVE-2014-3242MEDIUMCVSS v2 5.0EG 5.02014-05-12
SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
- CVE-2026-76427MEDIUMCVSS 4.9EG 4.92026-09-16
A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files that are stored on an affected device. This vulnerability is due to the parsing of attacker-controll…
- CVE-2026-76446MEDIUMCVSS 4.9EG 4.92026-09-16
A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restricti…
- CVE-2026-33913MEDIUMCVSS 4.9EG 4.92026-03-25
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containi…
- CVE-2026-23795MEDIUMCVSS 4.9EG 4.92026-02-03
Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE…
- CVE-2026-20029MEDIUMCVSS 4.9EG 4.92026-01-07
A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensit…
- CVE-2025-68463MEDIUMCVSS 4.9EG 4.92025-12-18
Bio.Entrez in Biopython through 186 allows doctype XXE.
- CVE-2025-24911MEDIUMCVSS 4.9EG 4.92025-04-16
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of…
- CVE-2025-24910MEDIUMCVSS 4.9EG 4.92025-04-16
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of…
- CVE-2025-24521MEDIUMCVSS 4.9EG 4.92025-03-05
External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remedia…
- CVE-2023-4554MEDIUMCVSS 4.9EG 4.92024-01-29
Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files. AppBuilder's XML processor is vulnerable to XML External Entity Processin…
- CVE-2023-35786MEDIUMCVSS 4.9EG 4.92023-07-05
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
- CVE-2023-20174MEDIUMCVSS 4.9EG 4.92023-05-18
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an …
- CVE-2023-20173MEDIUMCVSS 4.9EG 4.92023-05-18
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an …
- CVE-2023-29443MEDIUMCVSS 4.9EG 4.92023-04-26
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML…
- CVE-2022-45326MEDIUMCVSS 4.9EG 4.92022-12-06
An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.
- CVE-2022-40771MEDIUMCVSS 4.9EG 4.92022-11-23
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
- CVE-2022-24898MEDIUMCVSS 4.9EG 4.92022-04-28
org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the u…
- CVE-2022-23031MEDIUMCVSS 4.9EG 4.92022-01-25
On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Adv…
- CVE-2021-28973MEDIUMCVSS 4.9EG 4.92021-04-13
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.
- CVE-2020-27017MEDIUMCVSS 4.9EG 4.92020-11-09
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must …
- CVE-2020-8256MEDIUMCVSS 4.9EG 4.92020-09-30
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.
- CVE-2020-15772MEDIUMCVSS 4.9EG 4.92020-09-18
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this fil…
- CVE-2020-3256MEDIUMCVSS 4.9EG 4.92020-05-06
A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected syste…
- CVE-2020-6187MEDIUMCVSS 4.9EG 4.92020-02-12
SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service.
- CVE-2019-15983MEDIUMCVSS 4.9EG 4.92020-01-06
A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker w…
- CVE-2019-20153MEDIUMCVSS 4.9EG 4.92020-01-05
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote …
- CVE-2019-8126MEDIUMCVSS 4.9EG 4.92019-11-05
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document ty…
- CVE-2019-9488MEDIUMCVSS 4.9EG 4.92019-09-11
Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is…
- CVE-2019-11519MEDIUMCVSS 4.9EG 4.92019-04-25
Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.
- CVE-2019-1698MEDIUMCVSS 4.9EG 4.92019-02-21
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. Th…
- CVE-2019-0265MEDIUMCVSS 4.9EG 4.92019-02-15
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7…
- CVE-2018-11719MEDIUMCVSS 4.9EG 4.92018-08-30
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
- CVE-2016-9491MEDIUMCVSS 4.9EG 4.92018-07-13
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Appl…
- CVE-2018-10077MEDIUMCVSS 4.9EG 4.92018-04-20
XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data.
- CVE-2026-57917MEDIUMCVSS 4.8EG 4.82026-07-27
proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerabili…
- CVE-2020-25817MEDIUMCVSS 4.8EG 4.82021-06-08
SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for pu…
- CVE-2026-76572MEDIUMCVSS 4.7EG 4.72026-08-19
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The att…
- CVE-2021-45096MEDIUMCVSS 4.7EG 4.72021-12-16
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.
- CVE-2019-0948MEDIUMCVSS 4.7EG 4.72019-06-12
An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could rea…
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →