CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,422 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 14 of 29
- CVE-2023-42346HIGHCVSS 7.5EG 7.52026-05-08
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
- CVE-2024-13971HIGHCVSS 7.5EG 7.52026-04-30
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform …
- CVE-2024-39847HIGHCVSS 7.5EG 7.52026-04-30
Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GE…
- CVE-2026-41066HIGHCVSS 7.5EG 7.52026-04-24
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the res…
- CVE-2026-22016HIGHCVSS 7.5EG 7.52026-04-21
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17…
- CVE-2024-2374HIGHCVSS 7.5EG 7.52026-04-16
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's …
- CVE-2026-26171HIGHCVSS 7.5EG 7.52026-04-14
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
- CVE-2026-1567HIGHCVSS 7.5EG 7.52026-03-03
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 An XML External Entity (XXE) vulnerability in IBM InfoSphere Information Server could allow attackers to retrieve sensitive information from the server.
- CVE-2026-2252HIGHCVSS 7.5EG 7.52026-02-27
An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to an…
- CVE-2025-14478HIGHCVSS 7.5EG 7.52026-01-17
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Au…
- CVE-2019-25253HIGHCVSS 7.5EG 7.52025-12-24
KYOCERA Net Admin 3.4.0906 contains an XML External Entity (XXE) injection vulnerability in the Multi-Set Template Editor that allows unauthenticated attackers to read arbitrary system files. Attackers can craft a malicious XML file with e…
- CVE-2025-11700HIGHCVSS 7.5EG 7.52025-11-12
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
- CVE-2025-64518HIGHCVSS 7.5EG 7.52025-11-10
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-c…
- CVE-2025-63551HIGHCVSS 7.5EG 7.52025-11-06
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows…
- CVE-2025-6985HIGHCVSS 7.5EG 7.52025-10-06
The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets…
- CVE-2025-6984HIGHCVSS 7.5EG 7.52025-09-04
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.i…
- CVE-2025-8355HIGHCVSS 7.5EG 7.52025-08-08
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
- CVE-2025-52888HIGHCVSS 7.5EG 7.52025-06-24
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to secu…
- CVE-2025-44044HIGHCVSS 7.5EG 7.52025-06-10
Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operat…
- CVE-2025-31497HIGHCVSS 7.5EG 7.52025-04-15
TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service contains a critical XML External Entity (XXE) Injection vulnerability in its doc…
- CVE-2025-23195HIGHCVSS 7.5EG 7.52025-01-21
An XML External Entity (XXE) vulnerability exists in the Ambari/Oozie project, allowing an attacker to inject malicious XML entities. This vulnerability occurs due to insecure parsing of XML input using the `DocumentBuilderFactory` clas…
- CVE-2024-46603HIGHCVSS 7.5EG 7.52025-01-07
An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.
- CVE-2024-46602HIGHCVSS 7.5EG 7.52025-01-07
An issue was discovered in Elspec G5 digital fault recorder version 1.2.1.12 and earlier. An XML External Entity (XXE) vulnerability may allow an attacker to cause a Denial of Service (DoS) via a crafted XML payload.
- CVE-2023-24466HIGHCVSS 7.5EG 7.52024-11-22
Possible XML External Entity Injection in iManager GET parameter has been discovered in OpenText™ iManager 3.2.6.0200.
- CVE-2024-48917HIGHCVSS 7.5EG 7.52024-11-18
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported `CVE-2024-47873`, the regexes from the `f…
- CVE-2024-47873HIGHCVSS 7.5EG 7.52024-11-18
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, prior to versions 1.9.4, 2.1.3, 2.3.2, and 3.4.0, the regexes used in the `scan` m…
- CVE-2024-28168HIGHCVSS 7.5EG 7.52024-10-09
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.
- CVE-2024-45293HIGHCVSS 7.5EG 7.52024-10-07
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces.…
- CVE-2024-46985HIGHCVSS 7.5EG 7.52024-09-23
DataEase is an open source data visualization analysis tool. Prior to version 2.10.1, there is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to imple…
- CVE-2024-38374HIGHCVSS 7.5EG 7.52024-06-28
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, _cyclonedx-core-java_ leverage…
- CVE-2021-47621HIGHCVSS 7.5EG 7.52024-06-21
ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
- CVE-2024-36827HIGHCVSS 7.5EG 7.52024-06-07
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
- CVE-2023-51591HIGHCVSS 7.5EG 7.52024-05-03
Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPow…
- CVE-2023-40507HIGHCVSS 7.5EG 7.52024-05-03
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…
- CVE-2023-40506HIGHCVSS 7.5EG 7.52024-05-03
LG Simple Editor copyContent XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…
- CVE-2023-40503HIGHCVSS 7.5EG 7.52024-05-03
LG Simple Editor saveXmlFile XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is…
- CVE-2023-45139HIGHCVSS 7.5EG 7.52024-01-10
fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), wh…
- CVE-2023-6280HIGHCVSS 7.5EG 7.52023-12-19
An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve f…
- CVE-2023-6836HIGHCVSS 7.5EG 7.52023-12-15
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
- CVE-2023-22274HIGHCVSS 7.5EG 7.52023-11-17
Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to information disclosure by an unauthenticated attacker. Exploitation of this i…
- CVE-2023-46590HIGHCVSS 7.5EG 7.52023-11-14
A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE) injection vulnerability. This vulnerability could allow an attacker to interfer…
- CVE-2023-38343HIGHCVSS 7.5EG 7.52023-09-21
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can le…
- CVE-2023-40239HIGHCVSS 7.5EG 7.52023-09-01
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model …
- CVE-2020-26710HIGHCVSS 7.5EG 7.52023-06-29
easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
- CVE-2020-26709HIGHCVSS 7.5EG 7.52023-06-29
py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
- CVE-2020-26708HIGHCVSS 7.5EG 7.52023-06-29
requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
- CVE-2023-34411HIGHCVSS 7.5EG 7.52023-06-05
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
- CVE-2023-27527HIGHCVSS 7.5EG 7.52023-05-10
Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
- CVE-2022-38840HIGHCVSS 7.5EG 7.52023-04-16
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.
- CVE-2023-28828HIGHCVSS 7.5EG 7.52023-04-11
A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →