CWE-112— Missing XML Validation
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.— MITRE CWE catalog
14 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-112page 1 of 1
- CVE-2025-68493HIGHCVSS 8.1EG 8.42026-01-11
Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the …
- CVE-2022-28213HIGHCVSS 8.1EG 8.12022-04-12
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retr…
- CVE-2013-4002HIGHCVSS v2 7.1EG 7.12013-07-23
XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and …
- CVE-2020-1975MEDIUMCVSS 6.8EG 6.82020-02-12
Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier …
- CVE-2013-7315MEDIUMCVSS v2 6.8EG 6.82014-01-23
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of ser…
- CVE-2023-40310MEDIUMCVSS 6.5EG 6.52023-10-10
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A…
- CVE-2022-28217MEDIUMCVSS 6.5EG 6.52022-06-13
Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary to exploit unprotected XML parking at endpoints, and a possibility to conduct SSR…
- CVE-2021-1359MEDIUMCVSS 6.3EG 6.32021-07-08
A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to…
- CVE-2025-47184MEDIUMCVSS 5.3EG 5.32025-08-21
An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escal…
- CVE-2021-27780MEDIUMCVSS 5.3EG 5.32022-05-27
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
- CVE-2013-2160MEDIUMCVSS v2 5.0EG 5.02013-08-19
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (…
- CVE-2020-27282MEDIUMCVSS 4.3EG 4.32021-03-15
In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows privileged attackers with physical access to render the device persistently unusable by uploading specially crafted co…
- CVE-2014-0119MEDIUMCVSS v2 4.3EG 4.32014-05-31
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a cr…
- CVE-2026-1190LOWCVSS 3.1EG 3.12026-01-26
A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationDat…
Map vulnerabilities like CWE-112 to your infrastructure
EchelonGraph correlates every CVE — across CWE-112 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →