CVE-2026-24329 | Medium | 4.9 | 2026-08-11 | A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the… |
CVE-2026-59728 | Medium | 4.3 | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/s… |
CVE-2026-15037 | | | 2026-07-23 | Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrus… |
CVE-2026-55789 | High | 8.5 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML resp… |
CVE-2026-53723 | Medium | 5.8 | 2026-06-11 | Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, an… |
CVE-2026-46490 | High | 8.8 | 2026-06-08 | samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted… |
CVE-2026-11169 | High | 8.1 | 2026-06-04 | Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted… |
CVE-2026-47273 | Medium | 6.5 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb builds XPath expressions from user-supplied identifi… |
CVE-2026-40165 | High | 8.7 | 2026-05-21 | authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypas… |
CVE-2026-44665 | Medium | 6.1 | 2026-05-13 | fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the att… |
CVE-2026-44664 | Medium | 6.1 | 2026-05-13 | fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--… |
CVE-2026-41650 | Medium | 6.1 | 2026-05-07 | fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "… |
CVE-2026-41675 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-41674 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-41672 | High | 7.5 | 2026-05-07 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0… |
CVE-2026-27693 | Medium | 5.4 | 2026-05-05 | Traccar is an open source GPS tracking system. In org.traccar:traccar versions starting at 6.11.1 before 6.13.0, the KML and GPX export functionality writes de… |
CVE-2026-32870 | High | 7.5 | 2026-04-24 | Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already… |
CVE-2026-34601 | High | 7.5 | 2026-04-02 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xm… |
CVE-2026-28770 | High | 8.8 | 2026-03-04 | Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Sate… |
CVE-2026-1554 | Medium | 4.2 | 2026-02-04 | XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Cen… |
CVE-2022-50902 | High | 8.4 | 2026-01-13 | Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService that allows local users to potentially execute code with elevated pri… |
CVE-2025-1545 | High | 7.5 | 2025-12-04 | An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox confi… |
CVE-2025-66034 | Medium | 6.3 | 2025-11-29 | fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLi… |
CVE-2025-12921 | Medium | 4.3 | 2025-11-10 | A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFD… |
CVE-2025-7473 | Medium | 5.2 | 2025-10-21 | Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection. |
CVE-2025-60833 | Medium | 6.5 | 2025-10-08 | An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying cra… |
CVE-2025-54251 | Medium | 4.3 | 2025-09-09 | Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-pri… |
CVE-2025-24404 | High | 8.8 | 2025-09-09 | XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat.
The attacker needs to have an authenticated account with ac… |
CVE-2025-9375 | | | 2025-09-01 | XML Injection vulnerability in xmltodict allows Input Data Manipulation.
This issue affects xmltodict: from 0.14.2 before 0.15.1.
NOTE: the scope of this CVE… |
CVE-2025-47184 | Medium | 5.3 | 2025-08-21 | An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authentica… |
CVE-2025-49538 | High | 7.4 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attac… |
CVE-2025-25589 | High | 8.1 | 2025-03-18 | An XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackers to execute arbitr… |
CVE-2024-47113 | High | 8.1 | 2025-01-18 | IBM ICP - Voice Gateway 1.0.2, 1.0.2.4, 1.0.3, 1.0.4, 1.0.5, 1.0.6. 1.0.7, 1.0.7.1, and 1.0.8 could allow remote attacker to send specially crafted XML stateme… |
CVE-2024-13190 | Medium | 6.3 | 2025-01-08 | A vulnerability classified as critical was found in ZeroWdd myblog 1.0. This vulnerability affects unknown code of the file src/main/resources/mapper/BlogMappe… |
CVE-2024-53675 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-53674 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-11622 | High | 7.3 | 2024-11-26 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. |
CVE-2024-51136 | Critical | 9.8 | 2024-11-04 | An XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitrary code via suppl… |
CVE-2024-34740 | High | 7.8 | 2024-08-15 | In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could l… |
CVE-2024-42374 | High | 8.2 | 2024-08-13 | BEx Web Java Runtime Export Web Service does not
sufficiently validate an XML document accepted from an untrusted source. An
attacker can retrieve information… |
CVE-2023-35858 | Medium | 5.3 | 2024-06-13 | XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker to obtain application… |
CVE-2024-33858 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could… |
CVE-2023-32173 | Medium | 5.8 | 2024-05-03 | Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service… |
CVE-2023-27328 | High | 7.8 | 2024-05-03 | Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2024-28109 | High | 8.1 | 2024-03-28 | veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote… |
CVE-2024-2648 | Medium | 4.3 | 2024-03-19 | A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the fi… |
CVE-2024-2645 | Medium | 4.3 | 2024-03-19 | A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb… |
CVE-2024-25413 | High | 7.2 | 2024-02-16 | A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary comm… |
CVE-2023-46214 | High | 8.0 | 2023-11-16 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that user… |
CVE-2022-32755 | Medium | 5.5 | 2023-10-14 | IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit th… |
CVE-2023-43187 | Critical | 9.8 | 2023-09-27 | A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitra… |
CVE-2022-4245 | Medium | 4.3 | 2023-09-25 | A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment fails to sanitize comments for a --> sequence. This issue mean… |
CVE-2019-19450 | Critical | 9.8 | 2023-09-20 | paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element i… |
CVE-2023-40612 | Medium | 5.3 | 2023-08-23 | In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2, the file editor which is accessible to any user with ROLE_FILESYSTEM_EDITOR privileges is vulnerabl… |
CVE-2022-46751 | High | 8.2 | 2023-08-21 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This is… |
CVE-2023-38207 | High | 7.5 | 2023-08-09 | Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) v… |
CVE-2023-29289 | Medium | 6.5 | 2023-06-15 | Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by an XML Injection vulnerability. An attacker with… |
CVE-2019-25137 | High | 7.2 | 2023-05-18 | Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/… |
CVE-2023-22247 | High | 7.5 | 2023-03-27 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file syst… |
CVE-2023-27253 | High | 8.8 | 2023-03-17 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via… |
CVE-2023-22485 | Medium | 5.3 | 2023-01-24 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior 0.29.0.gfm.7, a crafted markdown document c… |
CVE-2021-4140 | Critical | 10.0 | 2022-12-22 | It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96… |
CVE-2022-35259 | High | 7.8 | 2022-12-05 | XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges. |
CVE-2022-27233 | Medium | 6.5 | 2022-11-11 | XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unauthenticated user to… |
CVE-2022-22244 | Medium | 5.3 | 2022-10-18 | An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POST to reach the XPa… |
CVE-2022-22243 | Medium | 4.3 | 2022-10-18 | An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to add a… |
CVE-2022-34253 | High | 7.2 | 2022-08-16 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Mo… |
CVE-2022-2458 | High | 8.2 | 2022-08-10 | XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs whe… |
CVE-2022-33739 | High | 7.5 | 2022-06-16 | CA Clarity 15.8 and below and 15.9.0 contain an insecure XML parsing vulnerability that could allow a remote attacker to potentially view the contents of any f… |
CVE-2022-22784 | High | 8.1 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This ca… |
CVE-2021-27777 | High | 7.5 | 2022-05-12 | XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attacke… |
CVE-2022-20729 | Medium | 4.4 | 2022-05-03 | A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. Thi… |
CVE-2022-25356 | Medium | 5.3 | 2022-04-05 | Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection. |
CVE-2022-22834 | High | 8.8 | 2022-03-10 | An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Inject… |
CVE-2021-38948 | Critical | 9.1 | 2021-11-02 | IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit… |
CVE-2021-22524 | Medium | 5.4 | 2021-09-13 | Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4 |
CVE-2021-39181 | High | 8.8 | 2021-09-01 | OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared import XML file (e.g. a course) any cl… |
CVE-2021-36033 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Mod… |
CVE-2021-36028 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a conf… |
CVE-2021-36022 | Critical | 9.1 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Upd… |
CVE-2021-36020 | High | 8.2 | 2021-09-01 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' fiel… |
CVE-2021-36359 | High | 8.8 | 2021-08-30 | OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (r… |
CVE-2021-32758 | High | 7.2 | 2021-08-27 | OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute ar… |
CVE-2021-37154 | Critical | 9.8 | 2021-08-25 | In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion. |
CVE-2021-32796 | Medium | 6.5 | 2021-07-27 | xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not c… |
CVE-2021-2322 | High | 8.8 | 2021-06-23 | Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker… |
CVE-2021-31347 | Medium | 6.5 | 2021-04-16 | An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writin… |
CVE-2021-21025 | Critical | 9.1 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful… |
CVE-2021-21019 | Critical | 9.1 | 2021-02-11 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploita… |
CVE-2020-29599 | High | 7.8 | 2020-12-07 | ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. Th… |
CVE-2017-15685 | High | 8.6 | 2020-11-27 | Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML tha… |
CVE-2017-15683 | High | 8.6 | 2020-11-27 | In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-o… |
CVE-2020-29128 | Critical | 9.8 | 2020-11-26 | petl before 1.68, in some configurations, allows resolution of entities in an XML document. |
CVE-2020-4774 | Medium | 5.4 | 2020-10-12 | An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a sp… |
CVE-2020-25216 | Critical | 9.8 | 2020-09-17 | yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet. |
CVE-2020-6271 | High | 8.2 | 2020-06-10 | SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of me… |
CVE-2020-6260 | Medium | 5.3 | 2020-06-10 | SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete X… |
CVE-2020-8479 | Critical | 9.4 | 2020-04-29 | For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI… |
CVE-2020-11535 | Critical | 9.8 | 2020-04-15 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-contr… |
CVE-2015-6970 | Critical | 9.8 | 2020-02-18 | The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injectio… |