CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 2)
Page 2 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68280 | Medium | 6.5 | 2026-01-05 | Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apac… |
CVE-2025-15251 | Medium | 5.6 | 2025-12-30 | A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/jav… |
CVE-2019-25253 | High | 7.5 | 2025-12-24 | KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers… |
CVE-2018-25142 | Critical | 9.8 | 2025-12-24 | NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings… |
CVE-2024-58335 | Medium | 5.0 | 2025-12-24 | OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImp… |
CVE-2025-68463 | Medium | 4.9 | 2025-12-18 | Bio.Entrez in Biopython through 186 allows doctype XXE. |
CVE-2025-61823 | Medium | 6.2 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-61821 | Medium | 6.8 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-61813 | High | 7.4 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-66516 | High | 8.4 | 2025-12-04 | Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to… |
CVE-2025-65868 | High | 7.5 | 2025-12-03 | XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request. |
CVE-2025-66372 | Low | 2.8 | 2025-11-28 | Mustang before 2.16.3 allows exfiltrating files via XXE attacks. |
CVE-2025-66371 | Medium | 5.0 | 2025-11-28 | Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the file… |
CVE-2025-66370 | Medium | 5.0 | 2025-11-28 | Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the ser… |
CVE-2025-58360 | High | 8.2 | 2025-11-25 | GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External… |
CVE-2025-63917 | High | 7.1 | 2025-11-17 | PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's X… |
CVE-2025-13209 | Medium | 6.3 | 2025-11-15 | A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\jav… |
CVE-2025-11700 | High | 7.5 | 2025-11-12 | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure |
CVE-2025-64518 | High | 7.5 | 2025-11-10 | The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in ve… |
CVE-2025-63551 | High | 7.5 | 2025-11-06 | A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS… |
CVE-2025-10713 | Medium | 6.5 | 2025-11-05 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-suppli… |
CVE-2025-12531 | High | 7.1 | 2025-11-03 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote a… |
CVE-2025-64134 | High | 7.1 | 2025-10-29 | Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external en… |
CVE-2025-46425 | Medium | 6.5 | 2025-10-24 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privil… |
CVE-2025-6985 | High | 7.5 | 2025-10-06 | The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vul… |
CVE-2025-11341 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=S… |
CVE-2025-20369 | Medium | 4.6 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privil… |
CVE-2025-48006 | Critical | 9.1 | 2025-09-29 | Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitra… |
CVE-2025-11140 | High | 7.3 | 2025-09-29 | A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient… |
CVE-2025-11035 | Medium | 6.3 | 2025-09-26 | A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=Ge… |
CVE-2025-10816 | High | 7.3 | 2025-09-22 | A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&… |
CVE-2025-10183 | Critical | 9.1 | 2025-09-09 | A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary… |
CVE-2025-10092 | High | 7.3 | 2025-09-08 | A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add o… |
CVE-2025-10091 | High | 7.3 | 2025-09-08 | A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Ty… |
CVE-2023-7307 | | 2025-08-27 | Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection… | |
CVE-2025-35112 | Medium | 4.1 | 2025-08-26 | Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the t… |
CVE-2025-57704 | Medium | 5.5 | 2025-08-26 | Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability. |
CVE-2025-54988 | High | 8.4 | 2025-08-20 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML Exter… |
CVE-2025-4044 | High | 8.2 | 2025-08-19 | Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an ar… |
CVE-2025-26484 | Medium | 5.5 | 2025-08-14 | Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with re… |
CVE-2025-40584 | Medium | 5.5 | 2025-08-12 | A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions <… |
CVE-2025-54992 | | 2025-08-11 | OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in OpenKilda which in… | |
CVE-2025-8355 | High | 7.5 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing refe… |
CVE-2025-54254 | High | 8.6 | 2025-08-05 | Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could… |
CVE-2025-36608 | Medium | 6.5 | 2025-07-30 | Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged a… |
CVE-2025-26400 | Medium | 5.3 | 2025-07-29 | SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid… |
CVE-2025-54445 | High | 8.2 | 2025-07-23 | Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue aff… |
CVE-2025-7766 | High | 8.0 | 2025-07-22 | Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remo… |
CVE-2025-34142 | | 2025-07-22 | An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint. The SAML… | |
CVE-2025-36603 | Medium | 4.2 | 2025-07-21 | Dell AppSync, version(s) 4.6.0.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access… |
CVE-2025-7824 | High | 7.3 | 2025-07-19 | A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipula… |
CVE-2025-7823 | High | 7.3 | 2025-07-19 | A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx… |
CVE-2025-52162 | Medium | 6.5 | 2025-07-18 | agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability… |
CVE-2025-53621 | Medium | 6.9 | 2025-07-15 | DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection pos… |
CVE-2025-53689 | High | 8.8 | 2025-07-14 | Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privi… |
CVE-2025-7523 | High | 7.3 | 2025-07-13 | A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.messa… |
CVE-2025-6438 | | 2025-07-11 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external e… | |
CVE-2025-49544 | Medium | 6.8 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-49539 | Medium | 4.5 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-49535 | Critical | 9.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-49493 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. |
CVE-2025-52888 | High | 7.5 | 2025-06-24 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xun… |
CVE-2025-47293 | | 2025-06-19 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vu… | |
CVE-2025-33121 | High | 7.1 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2025-36049 | High | 8.8 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A rem… |
CVE-2025-44044 | High | 7.5 | 2025-06-10 | Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously c… |
CVE-2025-30220 | Critical | 9.9 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema da… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2025-31039 | Critical | 9.1 | 2025-06-09 | Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Cate… |
CVE-2025-5877 | Medium | 6.3 | 2025-06-09 | A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of… |
CVE-2025-48882 | | 2025-05-30 | PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the sta… | |
CVE-2025-4338 | Medium | 6.8 | 2025-05-22 | Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain cre… |
CVE-2025-4949 | Medium | 5.3 | 2025-05-21 | In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experim… |
CVE-2025-27523 | High | 8.7 | 2025-05-15 | XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manage… |
CVE-2025-4641 | | 2025-05-14 | Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing compo… | |
CVE-2025-4639 | | 2025-05-14 | CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos. This issue affects Peergos throu… | |
CVE-2025-47778 | | 2025-05-14 | Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can up… | |
CVE-2024-51445 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External… |
CVE-2025-30018 | High | 8.6 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a craft… |
CVE-2025-2777 | Critical | 9.3 | 2025-05-07 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing… |
CVE-2025-2776 | Critical | 9.3 | 2025-05-07 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, all… |
CVE-2025-2775 | Critical | 9.3 | 2025-05-07 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allow… |
CVE-2025-22478 | High | 8.1 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthent… |
CVE-2025-46726 | Critical | 9.1 | 2025-05-05 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class ma… |
CVE-2025-2905 | Critical | 9.1 | 2025-05-05 | Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resol… |
CVE-2025-34490 | Medium | 6.5 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP reques… |
CVE-2025-2070 | Medium | 5.0 | 2025-04-25 | An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a loc… |
CVE-2025-24911 | Medium | 4.9 | 2025-04-16 | Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-24910 | Medium | 4.9 | 2025-04-16 | Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-31497 | High | 7.5 | 2025-04-15 | TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service… |
CVE-2025-32406 | High | 8.6 | 2025-04-08 | An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML r… |
CVE-2025-32138 | Medium | 6.6 | 2025-04-04 | Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps google-maps-easy allows XML Injection.This issue affects Easy… |
CVE-2025-3241 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/c… |
CVE-2025-31487 | High | 7.7 | 2025-04-03 | The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged i… |
CVE-2025-1781 | Medium | 6.5 | 2025-03-28 | There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request fo… |
CVE-2025-29932 | Medium | 4.1 | 2025-03-25 | In JetBrains GoLand before 2025.1 an XXE during debugging was possible |
CVE-2025-25036 | Medium | 6.8 | 2025-03-21 | Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 be… |
CVE-2025-2365 | Medium | 6.3 | 2025-03-17 | A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeCh… |
CVE-2025-27136 | | 2025-03-10 | LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to… | |
CVE-2025-0162 | High | 7.1 | 2025-03-07 | IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated atta… |