CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,425 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 24 of 29

CVE-2026-1218MEDIUMCVSS 6.3EG 6.3
2026-01-20
A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichClientService. Performing a manipulation results in xml extern…
CVE-2025-13209MEDIUMCVSS 6.3EG 6.3
2025-11-15
A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation…
CVE-2025-3241MEDIUMCVSS 6.3EG 6.3
2025-04-04
A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of t…
CVE-2025-2365MEDIUMCVSS 6.3EG 6.3
2025-03-17
A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity referenc…
CVE-2025-1225MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interf…
CVE-2024-49535MEDIUMCVSS 6.3EG 6.3
2024-12-10
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide mali…
CVE-2024-8602MEDIUMCVSS 6.3EG 6.3
2024-10-14
When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Op…
CVE-2024-3930MEDIUMCVSS 6.3EG 6.3
2024-07-30
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.
CVE-2023-49234MEDIUMCVSS 6.3EG 6.3
2024-03-29
An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.
CVE-2024-2826MEDIUMCVSS 6.3EG 6.3
2024-03-22
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The a…
CVE-2023-30951MEDIUMCVSS 6.3EG 6.3
2023-08-03
The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).
CVE-2023-27554MEDIUMCVSS 6.3EG 6.3
2023-05-11
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory res…
CVE-2021-23418MEDIUMCVSS 6.3EG 6.3
2021-07-29
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
CVE-2017-18438MEDIUMCVSS 6.3EG 6.3
2019-08-02
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
CVE-2020-37192MEDIUMCVSS 6.2EG 6.2
2026-02-11
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that…
CVE-2025-61823MEDIUMCVSS 6.2EG 6.2
2025-12-10
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit…
CVE-2026-66089MEDIUMCVSS 6.1EG 6.1
2026-10-29
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the serv…
CVE-2026-73235MEDIUMCVSS 6.1EG 6.1
2026-08-11
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCS…
CVE-2026-44665MEDIUMCVSS 6.1EG 6.1
2026-05-13
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to in…
CVE-2025-47778MEDIUMCVSS 6.1EG 6.1
2025-05-14
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for …
CVE-2022-27193MEDIUMCVSS 6.1EG 6.1
2022-03-15
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the syst…
CVE-2019-18943MEDIUMCVSS 6.1EG 6.1
2021-02-26
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
CVE-2023-20030MEDIUMCVSS 6.0EG 6.0
2023-04-05
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an aff…
CVE-2019-0284MEDIUMCVSS 6.0EG 6.0
2019-04-10
SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE…
CVE-2023-46035MEDIUMCVSS 5.9EG 5.9
2026-09-14
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
CVE-2026-18061MEDIUMCVSS 5.9EG 5.9
2026-09-11
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files fro…
CVE-2026-19596MEDIUMCVSS 5.9EG 5.9
2026-09-10
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored…
CVE-2026-40991MEDIUMCVSS 5.9EG 5.9
2026-06-10
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attac…
CVE-2026-46722MEDIUMCVSS 5.9EG 5.9
2026-05-19
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieve…
CVE-2024-56356MEDIUMCVSS 5.9EG 5.9
2024-12-20
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVE-2024-6961MEDIUMCVSS 5.9EG 5.9
2024-07-21
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal fil…
CVE-2024-31139MEDIUMCVSS 5.9EG 5.9
2024-03-28
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
CVE-2023-23926MEDIUMCVSS 5.9EG 5.9
2023-02-16
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph d…
CVE-2019-8997MEDIUMCVSS 5.9EG 5.9
2019-03-21
An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or m…
CVE-2018-17247MEDIUMCVSS 5.9EG 5.9
2018-12-20
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could …
CVE-2016-6805MEDIUMCVSS 5.9EG 5.9
2017-04-07
Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
CVE-2017-6344MEDIUMCVSS 5.9EG 5.9
2017-02-27
XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document.
CVE-2025-49493MEDIUMCVSS 5.8EG 5.8
2025-06-30
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
CVE-2024-28039MEDIUMCVSS 5.8EG 5.8
2024-03-18
Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.
CVE-2022-43473MEDIUMCVSS 5.8EG 5.8
2023-03-30
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this v…
CVE-2016-7458MEDIUMCVSS 5.8EG 5.8
2016-12-29
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related …
CVE-2019-6194MEDIUMCVSS 5.7EG 5.7
2020-02-14
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure.
CVE-2018-0414MEDIUMCVSS 5.7EG 5.7
2018-10-05
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML …
CVE-2025-15251MEDIUMCVSS 5.6EG 5.6
2025-12-30
A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Messa…
CVE-2023-3892MEDIUMCVSS 5.6EG 5.6
2023-09-19
Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an a…
CVE-2020-14379MEDIUMCVSS 5.6EG 5.6
2022-08-16
A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
CVE-2026-82525MEDIUMCVSS 5.5EG 5.5
2026-09-03
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XS…
CVE-2026-82918MEDIUMCVSS 5.5EG 5.5
2026-09-03
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the s…
CVE-2026-75058MEDIUMCVSS 5.5EG 5.5
2026-08-17
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
CVE-2026-75055MEDIUMCVSS 5.5EG 5.5
2026-08-17
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →