/api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chained with an SSRF bug to gain remote command execution as root. It can be triggered…

CVE-2018-18659HIGHCVSS 7.5EG 7.5

2018-10-26

An issue was discovered in Arcserve Unified Data Protection (UDP) through 6.5 Update 4. There is a DDI-VRT-2018-19 Unauthenticated XXE in /management/UdpHttpService issue.

CVE-2018-18737HIGHCVSS 7.5EG 7.5

2018-10-29

An XXE issue was discovered in Douchat 4.0.4 because Data\notify.php calls simplexml_load_string. This can also be used for SSRF.

CVE-2018-18980HIGHCVSS 7.5EG 7.5

2018-11-06

An XML External Entity injection (XXE) vulnerability exists in Zoho ManageEngine Network Configuration Manager and OpManager before 12.3.214 via the RequestXML parameter in a /devices/ProcessRequest.do GET request. For example, the attacke…

CVE-2018-1905HIGHCVSS 7.1EG 7.1

2018-11-26

IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume …

CVE-2018-1920HIGHCVSS 7.1EG 7.1

2018-12-07

IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resou…

CVE-2018-19244HIGHCVSS 8.6EG 8.6

2018-11-13

An XML External Entity (XXE) vulnerability exists in the Charles 4.2.7 import/export setup option. If a user imports a "Charles Settings.xml" file from an attacker, an intranet network may be accessed and information may be leaked.

CVE-2018-19371MEDIUMCVSS 6.5EG 6.5

2019-01-02

The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system.

CVE-2018-1970HIGHCVSS 7.1EG 7.1

2019-02-04

IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM…

CVE-2018-19858HIGHCVSS 8.6EG 8.6

2019-01-30

PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an attacker passes HTML referencing an XML file (e.g., in an IFRAME element), PrinceXML will fetch the XML and parse it, thu…

CVE-2018-20000HIGHCVSS 7.5EG 7.5

2018-12-10

Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java and webdav/servlet/common/PostRequestPars.java.

CVE-2018-20059CRITICALCVSS 9.8EG 9.8

2018-12-11

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.

CVE-2018-20157HIGHCVSS 7.5EG 7.5

2018-12-15

The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.

CVE-2018-20160CRITICALCVSS 9.8EG 9.8

2019-05-29

ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.

CVE-2018-2019HIGHCVSS 7.1EG 7.1

2019-01-18

IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume mem…

CVE-2018-20222CRITICALCVSS 9.8EG 9.8

2019-04-04

XXE issue in Airsonic before 10.1.2 during parse.

CVE-2018-20233MEDIUMCVSS 6.5EG 6.5

2019-01-18

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML…

CVE-2018-20298MEDIUMCVSS 6.5EG 6.5

2018-12-19

S3 Browser before 8.1.5 contains an XML external entity (XXE) vulnerability, allowing remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server via the S3 protocol.

CVE-2018-20318CRITICALCVSS 9.8EG 9.8

2018-12-21

An issue was discovered in weixin-java-tools v3.2.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file.

CVE-2018-20433CRITICALCVSS 9.8EG 9.8

2018-12-24

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.

CVE-2018-20664CRITICALCVSS 9.8EG 9.8

2019-01-03

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.

CVE-2018-20687CRITICALCVSS 9.8EG 9.8

2019-11-18

An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) a…

CVE-2018-20733HIGHCVSS 7.5EG 7.5

2019-01-17

BI Web Services in SAS Web Infrastructure Platform before 9.4M6 allows XXE.

CVE-2018-20843HIGHCVSS 7.5EG 7.5

2019-06-24

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service att…

CVE-2018-2392HIGHCVSS 7.5EG 9.0

2018-02-14

Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.

CVE-2018-2393HIGHCVSS 7.5EG 7.5

2018-02-14

Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SAP Internet Graphics Server (IGS) to become unavailable.

CVE-2018-2401MEDIUMCVSS 5.4EG 8.8

2018-03-14

SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.

CVE-2018-2492HIGHCVSS 7.1EG 7.1

2018-12-11

SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted source. This is fixed in versions 7.2, 7.30, 7.31, 7.40 and 7.50.

CVE-2018-25082MEDIUMCVSS 6.3EG 6.3

2023-03-21

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgradi…

CVE-2018-25142CRITICALCVSS 9.8EG 9.8

2025-12-24

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve …

CVE-2018-3600MEDIUMCVSS 6.5EG 6.5

2018-02-09

A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.

CVE-2018-3881CRITICALCVSS 9.4EG 9.4

2018-08-01

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially crafted web request to FocalScope's server that could cause an XXE, and potentially…

CVE-2018-4942HIGHCVSS 7.5EG 7.5

2018-05-19

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Unsafe XML External Entity Processing vulnerability. Successful exploitation could lead to information disclosure.

CVE-2018-5433MEDIUMCVSS 6.5EG 6.5

2018-06-13

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML extern…

CVE-2018-5434MEDIUMCVSS 5.8EG 6.5

2018-06-13

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host mac…

CVE-2018-5758MEDIUMCVSS 6.5EG 6.5

2018-03-12

The Upload File functionality in upload.jspa in Aurea Jive Jive-n 9.0.2.1 On-Premises allows for an XML External Entity attack through a crafted file, allowing attackers to read arbitrary files.

CVE-2018-5789HIGHCVSS 7.5EG 7.5

2018-02-05

An issue was discovered in Extreme Networks ExtremeWireless WiNG 5.x before 5.8.6.9 and 5.9.x before 5.9.1.3. There is a Remote, Unauthenticated XML Entity Expansion Denial of Service on the WiNG Access Point / Controller via crafted XML e…

CVE-2018-6225MEDIUMCVSS 4.3EG 4.3

2018-03-15

An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script.

CVE-2018-6486HIGHCVSS 7.3EG 9.8

2018-02-02

XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity…

CVE-2018-6489CRITICALCVSS 9.8EG 9.8

2018-02-22

XML External Entity (XXE) vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32. This vulnerability can be exploited to allow XML External Entity (XXE)

CVE-2018-6670HIGHCVSS 7.6EG 6.5

2018-06-07

External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.

CVE-2018-7063HIGHCVSS 8.1EG 8.1

2018-12-07

In Aruba ClearPass, disabled API admins can still perform read/write operations. In certain circumstances, API admins in ClearPass which have been disabled may still be able to perform read/write operations on parts of the XML API. This ca…

CVE-2018-7230HIGHCVSS 8.8EG 8.8

2018-03-09

A XML external entity (XXE) vulnerability exists in the import.cgi of the web interface component of the Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67.

CVE-2018-7783HIGHCVSS 7.5EG 7.5

2018-07-03

Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of…

CVE-2018-7837HIGHCVSS 7.5EG 7.5

2018-12-24

An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow the software to resolve documents outside of the intended sphere of control, cau…

CVE-2018-8010MEDIUMCVSS 5.5EG 5.5

2018-05-21

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these con…

CVE-2018-8026MEDIUMCVSS 5.5EG 5.5

2018-07-05

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition…

CVE-2018-8027CRITICALCVSS 9.8EG 9.8

2018-07-31

Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.

CVE-2018-8420HIGHCVSS 8.8EG 8.8

2018-09-13

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows …

CVE-2018-8494HIGHCVSS 8.8EG 8.8

2018-10-10

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows …

CWE-611— Improper Restriction of XML External Entity Reference (XXE)

CVEs classified under CWE-611page 5 of 23

Map vulnerabilities like CWE-611 to your infrastructure