CWE-611 · Improper Restriction of XML External Entity Reference (XXE) (page 3)
Page 3 of 13 — CVEs classified under CWE-611, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24521 | Medium | 4.9 | 2025-03-05 | External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combinatio… |
CVE-2023-38693 | Critical | 9.8 | 2025-03-05 | Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vuln… |
CVE-2024-49781 | High | 7.1 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2023-47160 | High | 8.2 | 2025-02-19 | IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing… |
CVE-2024-25066 | Medium | 4.3 | 2025-02-17 | RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being sto… |
CVE-2025-1225 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/m… |
CVE-2024-54171 | High | 7.1 | 2025-02-06 | IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerab… |
CVE-2024-49352 | High | 7.1 | 2025-02-05 | IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to an XML External Entity Injection (XXE)… |
CVE-2024-52807 | High | 8.6 | 2025-01-24 | The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various compone… |
CVE-2024-42185 | Low | 2.5 | 2025-01-23 | BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vuln… |
CVE-2025-23195 | High | 7.5 | 2025-01-21 | An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occu… |
CVE-2024-12476 | High | 7.8 | 2025-01-17 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and… |
CVE-2024-12298 | Medium | 5.5 | 2025-01-14 | We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerab… |
CVE-2024-46603 | High | 7.5 | 2025-01-07 | An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (Do… |
CVE-2024-46602 | High | 7.5 | 2025-01-07 | An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to c… |
CVE-2024-56324 | High | 7.1 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions prior to 24.4.0 can allow GoCD "group admins" to abuse ability to edit the raw XML configuration for groups… |
CVE-2024-56322 | High | 7.2 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 16.7.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse a hidden/unused configuration repository (p… |
CVE-2024-40896 | Critical | 9.1 | 2024-12-23 | In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers… |
CVE-2024-56356 | Medium | 5.9 | 2024-12-20 | In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack |
CVE-2024-55081 | Critical | 9.8 | 2024-12-19 | An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitrary code via supplyi… |
CVE-2021-22501 | | 2024-12-19 | Improper Restriction of XML External Entity Reference vulnerability in OpenText™ Operations Bridge Manager allows Input Data Manipulation. The vulnerability… | |
CVE-2024-55887 | High | 8.6 | 2024-12-13 | Ucum-java is a FHIR Java library providing UCUM Services. In versions prior to 1.0.9, XML parsing performed by the UcumEssenceService is vulnerable to XML exte… |
CVE-2024-55875 | Critical | 9.8 | 2024-12-12 | http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability… |
CVE-2024-49064 | Medium | 6.5 | 2024-12-12 | Microsoft SharePoint Information Disclosure Vulnerability |
CVE-2024-49535 | Medium | 6.3 | 2024-12-10 | Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML Externa… |
CVE-2024-54005 | Medium | 5.1 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-49704 | Medium | 5.5 | 2024-12-10 | A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All… |
CVE-2024-47582 | Medium | 5.3 | 2024-12-10 | Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This… |
CVE-2024-46455 | Critical | 9.8 | 2024-12-09 | unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser. |
CVE-2024-52806 | High | 8.3 | 2024-12-02 | SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's poss… |
CVE-2024-52596 | | 2024-12-02 | SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible… | |
CVE-2024-52800 | | 2024-11-29 | veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may th… | |
CVE-2024-9044 | | 2024-11-29 | A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Li… | |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2023-24466 | High | 7.5 | 2024-11-22 | Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200. |
CVE-2024-50848 | Medium | 6.5 | 2024-11-18 | An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive inform… |
CVE-2024-48917 | High | 7.5 | 2024-11-18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However… |
CVE-2024-47873 | High | 7.5 | 2024-11-18 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, pr… |
CVE-2020-26066 | Medium | 6.5 | 2024-11-18 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2024-39726 | High | 8.2 | 2024-11-15 | IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM… |
CVE-2021-1483 | Medium | 6.4 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information… |
CVE-2021-3902 | Critical | 9.8 | 2024-11-15 | An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserializatio… |
CVE-2024-5919 | Medium | 6.5 | 2024-11-14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary… |
CVE-2024-10218 | | 2024-11-12 | XSS Attack in mar.jar, Monitoring Archive Utility (MAR Utility), monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence | |
CVE-2024-52007 | High | 8.6 | 2024-11-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulne… |
CVE-2024-10839 | High | 8.5 | 2024-11-08 | Zohocorp ManageEngine SharePoint Manager Plus versions 4503 and prior are vulnerable to authenticated XML External Entity (XXE) in the Management option. |
CVE-2024-20531 | Medium | 5.5 | 2024-11-06 | A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected… |
CVE-2024-51132 | Critical | 9.8 | 2024-11-05 | An XML External Entity (XXE) vulnerability in HAPI FHIR before v6.4.0 allows attackers to access sensitive information or execute arbitrary code via supplying… |
CVE-2024-45086 | Medium | 5.5 | 2024-11-04 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-51136 | Critical | 9.8 | 2024-11-04 | An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via suppl… |
CVE-2024-50442 | Medium | 6.5 | 2024-10-28 | Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue a… |
CVE-2024-4690 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4189 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-4184 | High | 8.0 | 2024-10-16 | Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText A… |
CVE-2024-45072 | Medium | 5.5 | 2024-10-16 | IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could e… |
CVE-2024-21255 | High | 8.8 | 2024-10-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Supported versions that are affected are 8.59… |
CVE-2024-8602 | | 2024-10-14 | When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External E… | |
CVE-2024-28168 | High | 7.5 | 2024-10-09 | Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. User… |
CVE-2024-39586 | Low | 2.9 | 2024-10-09 | Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially e… |
CVE-2024-45293 | High | 7.5 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader… |
CVE-2024-45745 | Medium | 5.0 | 2024-09-27 | TopQuadrant TopBraid EDG before version 8.0.1 allows an authenticated attacker to upload an XML DTD file and execute JavaScript to read local files or access U… |
CVE-2024-46985 | High | 7.5 | 2024-09-23 | DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static res… |
CVE-2024-46984 | High | 8.6 | 2024-09-19 | The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location rou… |
CVE-2024-7098 | Critical | 9.8 | 2024-09-16 | Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4… |
CVE-2024-37397 | High | 8.2 | 2024-09-12 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthen… |
CVE-2023-37233 | High | 8.8 | 2024-09-10 | Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks. |
CVE-2024-45294 | High | 8.6 | 2024-09-06 | The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast Healthcare Interoperabil… |
CVE-2024-45490 | High | 7.5 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. |
CVE-2024-45048 | High | 8.8 | 2024-08-28 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions are subject to a bypassing of a filter which allows for an XX… |
CVE-2024-22218 | High | 8.8 | 2024-08-15 | XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users to submit maliciou… |
CVE-2024-38653 | High | 7.5 | 2024-08-14 | XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. |
CVE-2024-6893 | High | 7.5 | 2024-08-08 | The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read… |
CVE-2024-3930 | Medium | 6.3 | 2024-07-30 | In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered. |
CVE-2023-48362 | High | 8.8 | 2024-07-24 | XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malici… |
CVE-2024-40075 | Medium | 4.3 | 2024-07-22 | Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. |
CVE-2024-6961 | Medium | 5.9 | 2024-07-21 | RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from… |
CVE-2024-5625 | Medium | 6.5 | 2024-07-18 | Improper Restriction of XML External Entity Reference vulnerability in PruvaSoft Informatics Apinizer Management Console allows Data Serialization External Ent… |
CVE-2023-50304 | High | 7.1 | 2024-07-18 | IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A rem… |
CVE-2024-38374 | High | 7.5 | 2024-06-28 | The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deseria… |
CVE-2021-47621 | High | 7.5 | 2024-06-21 | ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks. |
CVE-2023-49110 | High | 7.2 | 2024-06-20 | When the Kiuwan Local Analyzer uploads the scan results to the Kiuwan SAST web application (either on-premises or cloud/SaaS solution), the transmitted data … |
CVE-2024-34102 | Critical | 9.8 | 2024-06-13 | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulner… |
CVE-2024-37388 | Critical | 9.1 | 2024-06-07 | An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cau… |
CVE-2024-36827 | High | 7.5 | 2024-06-07 | An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information o… |
CVE-2023-45192 | High | 8.2 | 2024-06-06 | IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A r… |
CVE-2024-3969 | High | 7.8 | 2024-05-28 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to remote code execution by parsing untrusted XML payload |
CVE-2024-4357 | Medium | 6.5 | 2024-05-15 | An information disclosure vulnerability exists in Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, allows low-privilege attacker to re… |
CVE-2024-3486 | High | 7.8 | 2024-05-15 | XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution. |
CVE-2024-30043 | Medium | 6.5 | 2024-05-14 | Microsoft SharePoint Server Information Disclosure Vulnerability |
CVE-2024-34345 | High | 8.1 | 2024-05-14 | The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, whe… |
CVE-2023-51605 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51604 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51602 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51601 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51600 | Medium | 6.5 | 2024-05-03 | Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2023-51591 | High | 7.5 | 2024-05-03 | Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to dis… |
CVE-2023-44412 | High | 8.2 | 2024-05-03 | D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive… |
CVE-2023-42035 | Medium | 6.5 | 2024-05-03 | Visualware MyConnection Server doIForward XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to di… |