CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,447 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 24 of 29

CVE-2018-5434MEDIUMCVSS 5.8EG 6.5
2018-06-13
The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host mac…
CVE-2021-1483MEDIUMCVSS 6.4EG 6.4
2024-11-15
A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper han…
CVE-2021-34706MEDIUMCVSS 6.4EG 6.4
2021-10-06
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an a…
CVE-2021-21266MEDIUMCVSS 6.4EG 6.4
2021-02-01
openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to ret…
CVE-2018-17152MEDIUMCVSS 6.4EG 6.4
2019-07-11
Intersystems Cache 2017.2.2.865.0 allows XXE.
CVE-2014-7839MEDIUMCVSS v2 6.4EG 6.4
2014-11-25
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vecto…
CVE-2014-2681MEDIUMCVSS v2 6.4EG 6.4
2014-11-16
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzur…
CVE-2013-6407MEDIUMCVSS v2 6.4EG 6.4
2013-12-07
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Ent…
CVE-2026-123824MEDIUMCVSS 6.3EG 6.3
2026-11-06
The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7…
CVE-2026-16999MEDIUMCVSS 6.3EG 6.3
2026-08-12
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
CVE-2026-12788MEDIUMCVSS 6.3EG 6.3
2026-06-21
A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /adpweb/a/base/barcodeDetail/import of the co…
CVE-2026-4980MEDIUMCVSS 6.3EG 6.3
2026-03-27
A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read local files via a crafted SVG file containing malicious xi:include tags.
CVE-2026-2536MEDIUMCVSS 6.3EG 6.3
2026-02-16
A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File c…
CVE-2026-2074MEDIUMCVSS 6.3EG 6.3
2026-02-07
A vulnerability was identified in O2OA up to 9.0.0. This impacts an unknown function of the file /x_program_center/jaxrs/mpweixin/check of the component HTTP POST Request Handler. The manipulation leads to xml external entity reference. It…
CVE-2026-1218MEDIUMCVSS 6.3EG 6.3
2026-01-20
A vulnerability was detected in Bjskzy Zhiyou ERP up to 11.0. Impacted is the function initRCForm of the file RichClientService.class of the component com.artery.richclient.RichClientService. Performing a manipulation results in xml extern…
CVE-2025-13209MEDIUMCVSS 6.3EG 6.3
2025-11-15
A weakness has been identified in bestfeng oa_git_free up to 9.5. This affects the function updateWriteBack of the file yimioa-oa9.5\server\c-flow\src\main\java\com\cloudweb\oa\controller\WorkflowPredefineController.java. This manipulation…
CVE-2025-3241MEDIUMCVSS 6.3EG 6.3
2025-04-04
A vulnerability, which was classified as problematic, was found in zhangyanbo2007 youkefu up to 4.2.0. This affects an unknown part of the file src/main/java/com/ukefu/webim/web/handler/admin/callcenter/CallCenterRouterController.java of t…
CVE-2025-2365MEDIUMCVSS 6.3EG 6.3
2025-03-17
A vulnerability, which was classified as problematic, has been found in crmeb_java up to 1.3.4. Affected by this issue is the function webHook of the file WeChatMessageController.java. The manipulation leads to xml external entity referenc…
CVE-2025-1225MEDIUMCVSS 6.3EG 6.3
2025-02-12
A vulnerability, which was classified as problematic, has been found in ywoa up to 2024.07.03. This issue affects the function extract of the file c-main/src/main/java/com/redmoon/weixin/aes/XMLParse.java of the component WXCallBack Interf…
CVE-2024-49535MEDIUMCVSS 6.3EG 6.3
2024-12-10
Acrobat Reader versions 24.005.20307, 24.001.30213, 24.001.30193, 20.005.30730, 20.005.30710 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that allows an attacker to provide mali…
CVE-2024-8602MEDIUMCVSS 6.3EG 6.3
2024-10-14
When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE (XML External Entity) attack. Further information on this can be found on the website of the Op…
CVE-2024-3930MEDIUMCVSS 6.3EG 6.3
2024-07-30
In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.
CVE-2023-49234MEDIUMCVSS 6.3EG 6.3
2024-03-29
An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server.
CVE-2024-2826MEDIUMCVSS 6.3EG 6.3
2024-03-22
A vulnerability classified as problematic was found in lakernote EasyAdmin up to 20240315. This vulnerability affects unknown code of the file /ureport/designer/saveReportFile. The manipulation leads to xml external entity reference. The a…
CVE-2023-30951MEDIUMCVSS 6.3EG 6.3
2023-08-03
The Foundry Magritte plugin rest-source was found to be vulnerable to an an XML external Entity attack (XXE).
CVE-2023-27554MEDIUMCVSS 6.3EG 6.3
2023-05-11
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory res…
CVE-2021-23418MEDIUMCVSS 6.3EG 6.3
2021-07-29
The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
CVE-2017-18438MEDIUMCVSS 6.3EG 6.3
2019-08-02
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).
CVE-2020-37192MEDIUMCVSS 6.2EG 6.2
2026-02-11
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. Attackers can exploit the 'Favorites' tab by injecting a malicious XML file that…
CVE-2025-61823MEDIUMCVSS 6.2EG 6.2
2025-12-10
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit…
CVE-2026-122985MEDIUMCVSS 6.1EG 6.1
2026-11-10
Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network.
CVE-2026-66089MEDIUMCVSS 6.1EG 6.1
2026-10-29
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the serv…
CVE-2026-73235MEDIUMCVSS 6.1EG 6.1
2026-08-11
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader() parses attacker-controlled Document.xml from a crafted .FCS…
CVE-2026-44665MEDIUMCVSS 6.1EG 6.1
2026-05-13
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to in…
CVE-2025-47778MEDIUMCVSS 6.1EG 6.1
2025-05-14
Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for …
CVE-2022-27193MEDIUMCVSS 6.1EG 6.1
2022-03-15
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the syst…
CVE-2019-18943MEDIUMCVSS 6.1EG 6.1
2021-02-26
Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) on certain operations.
CVE-2023-20030MEDIUMCVSS 6.0EG 6.0
2023-04-05
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an aff…
CVE-2019-0284MEDIUMCVSS 6.0EG 6.0
2019-04-10
SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from an untrusted source. The attacker can call SLDREG with an XML file containing a reference to an XML External Entity (XXE…
CVE-2023-46035MEDIUMCVSS 5.9EG 5.9
2026-09-14
The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.
CVE-2026-18061MEDIUMCVSS 5.9EG 5.9
2026-09-11
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files fro…
CVE-2026-19596MEDIUMCVSS 5.9EG 5.9
2026-09-10
An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled (for example a compromised monitored…
CVE-2026-40991MEDIUMCVSS 5.9EG 5.9
2026-06-10
When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attac…
CVE-2026-46722MEDIUMCVSS 5.9EG 5.9
2026-05-19
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieve…
CVE-2024-56356MEDIUMCVSS 5.9EG 5.9
2024-12-20
In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
CVE-2024-6961MEDIUMCVSS 5.9EG 5.9
2024-07-21
RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal fil…
CVE-2024-31139MEDIUMCVSS 5.9EG 5.9
2024-03-28
In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector
CVE-2023-23926MEDIUMCVSS 5.9EG 5.9
2023-02-16
APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. An XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin prior to version 5.5.0 and 4.4.0.14 (4.4 branch) in Neo4j graph d…
CVE-2019-8997MEDIUMCVSS 5.9EG 5.9
2019-03-21
An XML External Entity Injection (XXE) vulnerability in the Management System (console) of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or m…
CVE-2018-17247MEDIUMCVSS 5.9EG 5.9
2018-12-20
Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could …

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →