CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 3)
Page 3 of 14 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52162 | Medium | 6.5 | 2025-07-18 | agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity (XXE) via the RSSReader endpoint. This vulnerability… |
CVE-2025-53621 | Medium | 6.9 | 2025-07-15 | DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity (XXE) injection pos… |
CVE-2025-53689 | High | 8.8 | 2025-07-14 | Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privi… |
CVE-2025-7523 | High | 7.3 | 2025-07-13 | A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.messa… |
CVE-2025-6438 | | 2025-07-11 | A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of SOAP API calls and XML external e… | |
CVE-2025-49544 | Medium | 6.8 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-49539 | Medium | 4.5 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-49535 | Critical | 9.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-49493 | Medium | 5.8 | 2025-06-30 | Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection. |
CVE-2025-52888 | High | 7.5 | 2025-06-24 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xun… |
CVE-2025-47293 | | 2025-06-19 | PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vu… | |
CVE-2025-33121 | High | 7.1 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2025-36049 | High | 8.8 | 2025-06-18 | IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A rem… |
CVE-2025-44044 | High | 7.5 | 2025-06-10 | Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously c… |
CVE-2025-30220 | Critical | 9.9 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema da… |
CVE-2024-34711 | Critical | 9.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unautho… |
CVE-2025-31039 | Critical | 9.1 | 2025-06-09 | Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Cate… |
CVE-2025-5877 | Medium | 6.3 | 2025-06-09 | A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of… |
CVE-2025-48882 | | 2025-05-30 | PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the sta… | |
CVE-2025-4338 | Medium | 6.8 | 2025-05-22 | Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. An attacker could obtain cre… |
CVE-2025-4949 | Medium | 5.3 | 2025-05-21 | In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experim… |
CVE-2025-27523 | High | 8.7 | 2025-05-15 | XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manage… |
CVE-2025-4641 | | 2025-05-14 | Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing compo… | |
CVE-2025-4639 | | 2025-05-14 | CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos. This issue affects Peergos throu… | |
CVE-2025-47778 | | 2025-05-14 | Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can up… | |
CVE-2024-51445 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External… |
CVE-2025-30018 | High | 8.6 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a craft… |
CVE-2025-2777 | Critical | 9.3 | 2025-05-07 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing… |
CVE-2025-2776 | Critical | 9.3 | 2025-05-07 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, all… |
CVE-2025-2775 | Critical | 9.3 | 2025-05-07 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allow… |
CVE-2025-22478 | High | 8.1 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthent… |
CVE-2025-46726 | Critical | 9.1 | 2025-05-05 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class ma… |
CVE-2025-2905 | Critical | 9.1 | 2025-05-05 | Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resol… |
CVE-2025-34490 | Medium | 6.5 | 2025-04-28 | GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP reques… |
CVE-2025-2070 | Medium | 5.0 | 2025-04-25 | An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a loc… |
CVE-2025-24911 | Medium | 4.9 | 2025-04-16 | Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-24910 | Medium | 4.9 | 2025-04-16 | Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is… |
CVE-2025-31497 | High | 7.5 | 2025-04-15 | TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service… |
CVE-2025-32406 | High | 8.6 | 2025-04-08 | An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML r… |
CVE-2025-32138 | Medium | 6.6 | 2025-04-04 | Improper Restriction of XML External Entity Reference vulnerability in supsystic Easy Google Maps google-maps-easy allows XML Injection.This issue affects Easy… |
CVE-2025-3241 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/c… |
CVE-2025-31487 | High | 7.7 | 2025-04-03 | The XWiki JIRA extension provides various integration points between XWiki and JIRA (macros, UI, CKEditor plugin). If the JIRA macro is installed, any logged i… |
CVE-2025-1781 | Medium | 6.5 | 2025-03-28 | There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request fo… |
CVE-2025-29932 | Medium | 4.1 | 2025-03-25 | In JetBrains GoLand before 2025.1 an XXE during debugging was possible |
CVE-2025-25036 | Medium | 6.8 | 2025-03-21 | Improper Restriction of XML External Entity Reference vulnerability in Jalios JPlatform allows XML Injection.This issue affects all versions of JPlatform 10 be… |
CVE-2025-2365 | Medium | 6.3 | 2025-03-17 | A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeCh… |
CVE-2025-27136 | | 2025-03-10 | LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to… | |
CVE-2025-0162 | High | 7.1 | 2025-03-07 | IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated atta… |
CVE-2025-24521 | Medium | 4.9 | 2025-03-05 | External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combinatio… |
CVE-2023-38693 | Critical | 9.8 | 2025-03-05 | Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vuln… |
CVE-2024-49781 | High | 7.1 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2023-47160 | High | 8.2 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing… |
CVE-2024-25066 | Medium | 4.3 | 2025-02-17 | RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being sto… |
CVE-2025-1225 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/m… |
CVE-2024-54171 | High | 7.1 | 2025-02-06 | IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerab… |
CVE-2024-49352 | High | 7.1 | 2025-02-05 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE)… |
CVE-2024-52807 | High | 8.6 | 2025-01-24 | The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various compone… |
CVE-2024-42185 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vuln… |
CVE-2025-23195 | High | 7.5 | 2025-01-21 | An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occu… |
CVE-2024-12476 | High | 7.8 | 2025-01-17 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and… |
CVE-2024-12298 | Medium | 5.5 | 2025-01-14 | We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerab… |
CVE-2024-46603 | High | 7.5 | 2025-01-07 | An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (Do… |
CVE-2024-46602 | High | 7.5 | 2025-01-07 | An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to c… |
CVE-2024-56324 | High | 7.1 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups… |
CVE-2024-56322 | High | 7.2 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (p… |
CVE-2024-40896 | Critical | 9.1 | 2024-12-23 | In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers… |
CVE-2024-56356 | Medium | 5.9 | 2024-12-20 | In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
CVE-2024-55081 | Critical | 9.8 | 2024-12-19 | An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplyi… |
CVE-2021-22501 | | 2024-12-19 | Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability… | |
CVE-2024-55887 | High | 8.6 | 2024-12-13 | Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML exte… |
CVE-2024-55875 | Critical | 9.8 | 2024-12-12 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability… |
CVE-2024-49064 | Medium | 6.5 | 2024-12-12 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2024-49535 | Medium | 6.3 | 2024-12-10 | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML Externa… |
CVE-2024-54005 | Medium | 5.1 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-49704 | Medium | 5.5 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-47582 | Medium | 5.3 | 2024-12-10 | Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This… |
CVE-2024-46455 | Critical | 9.8 | 2024-12-09 | unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. |
CVE-2024-52806 | High | 8.3 | 2024-12-02 | SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's poss… |
CVE-2024-52596 | | 2024-12-02 | SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible… | |
CVE-2024-52800 | | 2024-11-29 | veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may th… | |
CVE-2024-9044 | | 2024-11-29 | A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Li… | |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2023-24466 | High | 7.5 | 2024-11-22 | Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200. |
CVE-2024-50848 | Medium | 6.5 | 2024-11-18 | An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive inform… |
CVE-2024-48917 | High | 7.5 | 2024-11-18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However… |
CVE-2024-47873 | High | 7.5 | 2024-11-18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, pr… |
CVE-2020-26066 | Medium | 6.5 | 2024-11-18 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2024-39726 | High | 8.2 | 2024-11-15 | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM… |
CVE-2021-1483 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2021-3902 | Critical | 9.8 | 2024-11-15 | An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializatio… |
CVE-2024-5919 | Medium | 6.5 | 2024-11-14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary… |
CVE-2024-10218 | | 2024-11-12 | XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence | |
CVE-2024-52007 | High | 8.6 | 2024-11-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulne… |
CVE-2024-10839 | High | 8.5 | 2024-11-08 | Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. |
CVE-2024-20531 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected… |
CVE-2024-51132 | Critical | 9.8 | 2024-11-05 | An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying… |
CVE-2024-45086 | Medium | 5.5 | 2024-11-04 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-51136 | Critical | 9.8 | 2024-11-04 | An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via suppl… |