CWE-611— Improper Restriction of XML External Entity Reference (XXE)
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog
1,447 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-611page 25 of 29
- CVE-2016-6805MEDIUMCVSS 5.9EG 5.92017-04-07
Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
- CVE-2017-6344MEDIUMCVSS 5.9EG 5.92017-02-27
XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document.
- CVE-2025-49493MEDIUMCVSS 5.8EG 5.82025-06-30
Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.
- CVE-2024-28039MEDIUMCVSS 5.8EG 5.82024-03-18
Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.
- CVE-2022-43473MEDIUMCVSS 5.8EG 5.82023-03-30
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this v…
- CVE-2016-7458MEDIUMCVSS 5.8EG 5.82016-12-29
VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related …
- CVE-2019-6194MEDIUMCVSS 5.7EG 5.72020-02-14
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure.
- CVE-2018-0414MEDIUMCVSS 5.7EG 5.72018-10-05
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected system. The vulnerability is due to improper handling of XML …
- CVE-2025-15251MEDIUMCVSS 5.6EG 5.62025-12-30
A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/java/com/fastbee/sip/handler/req/ReqAbstractHandler.java of the component SIP Messa…
- CVE-2023-3892MEDIUMCVSS 5.6EG 5.62023-09-19
Improper Restriction of XML External Entity Reference vulnerability in MIM Assistant and Client DICOM RTst Loading modules allows XML Entity Linking / XML External Entities Blowup. In order to take advantage of this vulnerability, an a…
- CVE-2020-14379MEDIUMCVSS 5.6EG 5.62022-08-16
A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
- CVE-2026-91876MEDIUMCVSS 5.5EG 5.52026-11-11
Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exp…
- CVE-2026-82525MEDIUMCVSS 5.5EG 5.52026-09-03
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XS…
- CVE-2026-82918MEDIUMCVSS 5.5EG 5.52026-09-03
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the s…
- CVE-2026-75058MEDIUMCVSS 5.5EG 5.52026-08-17
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
- CVE-2026-75055MEDIUMCVSS 5.5EG 5.52026-08-17
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
- CVE-2026-14304MEDIUMCVSS 5.5EG 5.52026-08-05
In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulne…
- CVE-2025-36374MEDIUMCVSS 5.5EG 5.52026-07-30
IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
- CVE-2026-6807MEDIUMCVSS 5.5EG 5.52026-04-28
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing…
- CVE-2025-57704MEDIUMCVSS 5.5EG 5.52025-08-26
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability.
- CVE-2025-26484MEDIUMCVSS 5.5EG 5.52025-08-14
Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of s…
- CVE-2025-40584MEDIUMCVSS 5.5EG 5.52025-08-12
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION S…
- CVE-2025-27136MEDIUMCVSS 5.5EG 5.52025-03-10
LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfigurati…
- CVE-2018-9379MEDIUMCVSS 5.5EG 5.52025-01-17
In multiple functions of MiniThumbFile.java, there is a possible way to view the thumbnails of deleted photos due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User in…
- CVE-2024-12298MEDIUMCVSS 5.5EG 5.52025-01-14
We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer.
- CVE-2024-49704MEDIUMCVSS 5.5EG 5.52024-12-10
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All vers…
- CVE-2024-20531MEDIUMCVSS 5.5EG 5.52024-11-06
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affec…
- CVE-2024-45086MEDIUMCVSS 5.5EG 5.52024-11-04
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory reso…
- CVE-2024-45072MEDIUMCVSS 5.5EG 5.52024-10-16
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory reso…
- CVE-2024-25971MEDIUMCVSS 5.5EG 5.52024-03-28
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.
- CVE-2023-25926MEDIUMCVSS 5.5EG 5.52024-02-29
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive inf…
- CVE-2024-1167MEDIUMCVSS 5.5EG 5.52024-02-01
When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.
- CVE-2024-22380MEDIUMCVSS 5.5EG 5.52024-01-24
Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity ref…
- CVE-2024-21796MEDIUMCVSS 5.5EG 5.52024-01-24
Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (Design & Survey Edition) prior to Ver1.0.4 improperly restrict XML external entity references (XXE). …
- CVE-2024-21765MEDIUMCVSS 5.5EG 5.52024-01-24
Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, Electronic Delivery Check System (Kikai) Ver.10.1.0 and earlier, and Electronic delivery item Inspection Su…
- CVE-2023-5136MEDIUMCVSS 5.5EG 5.52023-11-08
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.
- CVE-2023-46802MEDIUMCVSS 5.5EG 5.52023-11-06
e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By processing a specially crafted XML file, arbitrary files on the system may be read b…
- CVE-2023-43624MEDIUMCVSS 5.5EG 5.52023-10-23
CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensit…
- CVE-2022-32755MEDIUMCVSS 5.5EG 5.52023-10-14
IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. I…
- CVE-2023-42132MEDIUMCVSS 5.5EG 5.52023-10-02
FD Application Apr. 2022 Edition (Version 9.01) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- CVE-2023-24620MEDIUMCVSS 5.5EG 5.52023-08-25
An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small Y…
- CVE-2023-32639MEDIUMCVSS 5.5EG 5.52023-07-25
Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the system may be read by an attacker.
- CVE-2023-32635MEDIUMCVSS 5.5EG 5.52023-07-19
XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XBRL file, arbitrary files on the system may be read by an attacker.
- CVE-2023-37200MEDIUMCVSS 5.5EG 5.52023-07-12
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause loss of confidentiality when replacing a project file on the local filesystem and after manual restart of the server.
- CVE-2023-29498MEDIUMCVSS 5.5EG 5.52023-06-13
Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens a specially crafted project file, sensitive information on the system where the affected product is…
- CVE-2023-2806MEDIUMCVSS 5.5EG 5.52023-05-19
A vulnerability classified as problematic was found in Weaver e-cology up to 9.0. Affected by this vulnerability is the function RequestInfoByXml of the component API. The manipulation leads to xml external entity reference. The associated…
- CVE-2022-45876MEDIUMCVSS 5.5EG 5.52023-04-26
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
- CVE-2023-27652MEDIUMCVSS 5.5EG 5.52023-04-20
An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_info field of the _default_.xml file.
- CVE-2023-26264MEDIUMCVSS 5.5EG 5.52023-04-13
All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code.
- CVE-2023-26263MEDIUMCVSS 5.5EG 5.52023-04-13
All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoint of the remote harvesting server.
Map vulnerabilities like CWE-611 to your infrastructure
EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →