CWE-611— Improper Restriction of XML External Entity Reference (XXE)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.— MITRE CWE catalog

1,447 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-611page 28 of 29

CVE-2026-76446MEDIUMCVSS 4.9EG 4.9
2026-09-16
A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific files on the underlying operating system of an affected device. This vulnerability is due to improper restricti…
CVE-2026-33913MEDIUMCVSS 4.9EG 4.9
2026-03-25
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containi…
CVE-2026-23795MEDIUMCVSS 4.9EG 4.9
2026-02-03
Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE…
CVE-2026-20029MEDIUMCVSS 4.9EG 4.9
2026-01-07
A vulnerability in the licensing features of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker with administrative privileges to gain access to sensit…
CVE-2025-68463MEDIUMCVSS 4.9EG 4.9
2025-12-18
Bio.Entrez in Biopython through 186 allows doctype XXE.
CVE-2025-24911MEDIUMCVSS 4.9EG 4.9
2025-04-16
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of…
CVE-2025-24910MEDIUMCVSS 4.9EG 4.9
2025-04-16
Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of XML entities. It is possible to define an entity by providing a substitution string in the form of…
CVE-2025-24521MEDIUMCVSS 4.9EG 4.9
2025-03-05
External XML entity injection allows arbitrary download of files. The score without least privilege principle violation is as calculated below. In combination with other issues it may facilitate further compromise of the device. Remedia…
CVE-2023-4554MEDIUMCVSS 4.9EG 4.9
2024-01-29
Improper Restriction of XML External Entity Reference vulnerability in OpenText AppBuilder on Windows, Linux allows Server Side Request Forgery, Probe System Files. AppBuilder's XML processor is vulnerable to XML External Entity Processin…
CVE-2023-35786MEDIUMCVSS 4.9EG 4.9
2023-07-05
Zoho ManageEngine ADManager Plus before 7183 allows admin users to exploit an XXE issue to view files.
CVE-2023-20174MEDIUMCVSS 4.9EG 4.9
2023-05-18
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an …
CVE-2023-20173MEDIUMCVSS 4.9EG 4.9
2023-05-18
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an …
CVE-2023-29443MEDIUMCVSS 4.9EG 4.9
2023-04-26
Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer before 6989 allow SDAdmin attackers to conduct XXE attacks via a crafted server that sends malformed XML…
CVE-2022-45326MEDIUMCVSS 4.9EG 4.9
2022-12-06
An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.
CVE-2022-40771MEDIUMCVSS 4.9EG 4.9
2022-11-23
Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure.
CVE-2022-24898MEDIUMCVSS 4.9EG 4.9
2022-04-28
org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4, and 13.8-rc-1, it is possible for a script to access any file accessing to the u…
CVE-2022-23031MEDIUMCVSS 4.9EG 4.9
2022-01-25
On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerability exists in an undisclosed page of the F5 Advanced Web Application Firewall (Adv…
CVE-2021-28973MEDIUMCVSS 4.9EG 4.9
2021-04-13
The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks.
CVE-2020-27017MEDIUMCVSS 4.9EG 4.9
2020-11-09
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must …
CVE-2020-8256MEDIUMCVSS 4.9EG 4.9
2020-09-30
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.
CVE-2020-15772MEDIUMCVSS 4.9EG 4.9
2020-09-18
An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this fil…
CVE-2020-3256MEDIUMCVSS 4.9EG 4.9
2020-05-06
A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected syste…
CVE-2020-6187MEDIUMCVSS 4.9EG 4.9
2020-02-12
SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service.
CVE-2019-15983MEDIUMCVSS 4.9EG 4.9
2020-01-06
A vulnerability in the SOAP API of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. To exploit this vulnerability, an attacker w…
CVE-2019-20153MEDIUMCVSS 4.9EG 4.9
2020-01-05
An issue was discovered in Determine (formerly Selectica) Contract Lifecycle Management (CLM) in v5.4. An XML external entity (XXE) vulnerability in the upload definition feature in definition_upload_attach.jsp allows authenticated remote …
CVE-2019-8126MEDIUMCVSS 4.9EG 4.9
2019-11-05
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document ty…
CVE-2019-9488MEDIUMCVSS 4.9EG 4.9
2019-09-11
Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is…
CVE-2019-11519MEDIUMCVSS 4.9EG 4.9
2019-04-25
Libraries/Nop.Services/Localization/LocalizationService.cs in nopCommerce through 4.10 allows XXE via the "Configurations -> Languages -> Edit Language -> Import Resources -> Upload XML file" screen.
CVE-2019-1698MEDIUMCVSS 4.9EG 4.9
2019-02-21
A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. Th…
CVE-2019-0265MEDIUMCVSS 4.9EG 4.9
2019-02-15
SLD Registration of ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Fixed in versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT,KRNL32UC 7.21, 7.21EXT, 7.22, 7…
CVE-2018-11719MEDIUMCVSS 4.9EG 4.9
2018-08-30
Xovis PC2, PC2R, and PC3 devices through 3.6.0 allow XXE.
CVE-2016-9491MEDIUMCVSS 4.9EG 4.9
2018-07-13
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Appl…
CVE-2018-10077MEDIUMCVSS 4.9EG 4.9
2018-04-20
XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data.
CVE-2026-57917MEDIUMCVSS 4.8EG 4.8
2026-07-27
proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerabili…
CVE-2020-25817MEDIUMCVSS 4.8EG 4.8
2021-06-08
SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for pu…
CVE-2026-76572MEDIUMCVSS 4.7EG 4.7
2026-08-19
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The att…
CVE-2021-45096MEDIUMCVSS 4.7EG 4.7
2021-12-16
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.
CVE-2019-0948MEDIUMCVSS 4.7EG 4.7
2019-06-12
An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could rea…
CVE-2022-45194MEDIUMCVSS 3.8EG 4.7
2022-11-12
CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.
CVE-2024-9044MEDIUMCVSS 4.6EG 4.6
2024-11-29
A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.
CVE-2024-28198MEDIUMCVSS 4.6EG 4.6
2024-03-11
OpenOlat is an open source web-based e-learning platform for teaching, learning, assessment and communication. By manually manipulating http requests when using the draw.io integration it is possible to read arbitrary files as the configur…
CVE-2025-49539MEDIUMCVSS 4.5EG 4.5
2025-07-08
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could levera…
CVE-2026-101893MEDIUMCVSS 4.4EG 4.4
2026-10-05
Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatically parses every recognized job file extension on folder browse. A crafted file on any browsed netwo…
CVE-2021-21470MEDIUMCVSS 4.4EG 4.4
2021-01-12
SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacker with user privileges to parse malicious XML files which could result in XXE-based attacks in ap…
CVE-2020-4606MEDIUMCVSS 4.4EG 4.4
2021-01-08
IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A local attacker could exploit this vulnerability to expose sensitive information or consume memory resourc…
CVE-2018-0100MEDIUMCVSS 4.4EG 4.4
2018-01-18
A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to imp…
CVE-2026-123857MEDIUMCVSS 4.3EG 4.3
2026-11-06
In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection
CVE-2026-33371MEDIUMCVSS 4.3EG 4.3
2026-03-20
An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists in the Zimbra Exchange Web Services (EWS) SOAP interface due to improper handling of XML input. An authenticated attacke…
CVE-2024-25066MEDIUMCVSS 4.3EG 4.3
2025-02-17
RSA Authentication Manager before 8.7 SP2 Patch 1 allows XML External Entity (XXE) attacks via a license file, resulting in attacker-controlled files being stored on the product's server. Data exfiltration cannot occur.
CVE-2024-40075MEDIUMCVSS 4.3EG 4.3
2024-07-22
Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.

Map vulnerabilities like CWE-611 to your infrastructure

EchelonGraph correlates every CVE — across CWE-611 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →