CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,349 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 27 of 27

CVE-2022-45194MEDIUMCVSS 3.8EG 4.7
2022-11-12
CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.
CVE-2025-20369MEDIUMCVSS 4.6EG 4.6
2025-10-01
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an…
CVE-2024-9044MEDIUMCVSS 4.6EG 4.6
2024-11-29
A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.
CVE-2024-28198MEDIUMCVSS 4.6EG 4.6
2024-03-11
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configur…
CVE-2025-49539MEDIUMCVSS 4.5EG 4.5
2025-07-08
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could levera…
CVE-2026-101893MEDIUMCVSS 4.4EG 4.4
2026-10-05
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed netwo…
CVE-2021-21470MEDIUMCVSS 4.4EG 4.4
2021-01-12
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in ap…
CVE-2020-4606MEDIUMCVSS 4.4EG 4.4
2021-01-08
IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could exploit this vulnerability to expose sensitive information or consume memory resourc…
CVE-2018-0100MEDIUMCVSS 4.4EG 4.4
2018-01-18
A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to imp…
CVE-2026-33371MEDIUMCVSS 4.3EG 4.3
2026-03-20
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacke…
CVE-2024-25066MEDIUMCVSS 4.3EG 4.3
2025-02-17
RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur.
CVE-2024-40075MEDIUMCVSS 4.3EG 4.3
2024-07-22
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
CVE-2024-21048MEDIUMCVSS 4.3EG 4.3
2024-04-16
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: XML input). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged att…
CVE-2023-41365MEDIUMCVSS 4.3EG 4.3
2023-10-10
SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attack…
CVE-2022-4245MEDIUMCVSS 4.3EG 4.3
2023-09-25
A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue means that text contained in the command string could be interpreted as XML and allo…
CVE-2023-41369MEDIUMCVSS 4.3EG 4.3
2023-09-12
The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file get…
CVE-2022-20938MEDIUMCVSS 4.3EG 4.3
2022-11-15
A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view sensitive information. This vulnerability is due to …
CVE-2021-36172MEDIUMCVSS 4.3EG 4.3
2021-11-02
An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of…
CVE-2021-28684MEDIUMCVSS 4.3EG 4.3
2021-06-21
The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of local files over the network (via an XXE attack).
CVE-2015-7968MEDIUMCVSS 4.3EG 4.3
2020-03-09
nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI.
CVE-2018-6225MEDIUMCVSS 4.3EG 4.3
2018-03-15
An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script.
CVE-2016-0268MEDIUMCVSS 4.3EG 4.3
2018-03-09
XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and…
CVE-2017-10889MEDIUMCVSS 4.3EG 4.3
2017-11-17
TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.
CVE-2015-3160MEDIUMCVSS 4.3EG 4.3
2017-09-06
XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive information via submitting job XML to the server containing entity references which reference files f…
CVE-2017-3839MEDIUMCVSS 4.3EG 4.3
2017-02-22
An XML External Entity vulnerability in the web-based user interface of the Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to have read access to part of the information stored in the affected syst…
CVE-2016-4047MEDIUMCVSS 4.3EG 4.3
2016-12-15
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing cert…
CVE-2013-1824MEDIUMCVSS v2 4.3EG 4.3
2013-09-16
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML Exte…
CVE-2025-36603MEDIUMCVSS 4.2EG 4.2
2025-07-21
Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure …
CVE-2019-2861MEDIUMCVSS 4.2EG 4.2
2019-07-23
Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access…
CVE-2025-35112MEDIUMCVSS 4.1EG 4.1
2025-08-26
Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should …
CVE-2025-29932MEDIUMCVSS 4.1EG 4.1
2025-03-25
In JetBrains GoLand before 2025.1 an XXE during debugging was possible
CVE-2022-0861LOWCVSS 3.5EG 3.8
2022-03-23
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is lim…
CVE-2020-26229LOWCVSS 3.7EG 3.7
2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical …
CVE-2024-8010LOWCVSS 3.5EG 3.5
2026-04-16
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vu…
CVE-2026-49383LOWCVSS 3.3EG 3.3
2026-05-29
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
CVE-2020-12025LOWCVSS 3.3EG 3.3
2020-07-14
Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program.
CVE-2018-16252LOWCVSS 3.3EG 3.3
2018-09-05
FsPro Labs Event Log Explorer 4.6.1.2115 has ".elx" FileType XML External Entity Injection.
CVE-2018-0218LOWCVSS 3.3EG 3.3
2018-03-08
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerabi…
CVE-2018-0207LOWCVSS 3.3EG 3.3
2018-03-08
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerabi…
CVE-2018-0878LOWCVSS 3.1EG 3.1
2018-03-14
Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709…
CVE-2024-39586LOWCVSS 2.9EG 2.9
2024-10-09
Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure.
CVE-2025-66372LOWCVSS 2.8EG 2.8
2025-11-28
Mustang before 2.16.3 allows exfiltrating files via XXE attacks.
CVE-2025-47293LOWCVSS 2.7EG 2.7
2025-06-19
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request for…
CVE-2024-25129LOWCVSS 2.7EG 2.7
2024-02-22
The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser used by the CodeQL CLI to read various auxiliary files is vulnerable to an XML External Entity attack. If a vulnerable v…
CVE-2016-0369LOWCVSS 2.7EG 2.7
2018-02-21
XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 112088.
CVE-2026-57234LOWCVSS 2.6EG 2.6
2026-06-25
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on th…
CVE-2020-26247LOWCVSS 2.6EG 2.6
2020-12-30
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default…
CVE-2024-42185LOWCVSS 2.5EG 2.5
2025-01-23
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues i…
CVE-2024-52800LOWCVSS 2.3EG 2.3
2024-11-29
veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't af…

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →