← Back
CWE-611

1,303 CVEs • Abstraction: Base

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

JSON object

Loading...

CVEs (1,303)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-28152
1Independentsoft
1Jword
Jun 17, 2026
Mar 24, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in Independentsoft JWord before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.
CVE-2023-28685
1Jenkins
1Absint A3
Jun 17, 2026
Mar 22, 2023
N/A· v4
7.1 HIGH· v3
N/A· v2
Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-46300
1Visam
1Vbase Automation Base
Jun 17, 2026
Mar 21, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVE-2022-45468
1Visam
1Vbase Automation Base
Jun 17, 2026
Mar 21, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVE-2022-45121
1Visam
1Vbase Automation Base
Jun 17, 2026
Mar 21, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVE-2022-43512
1Visam
1Vbase Automation Base
Jun 17, 2026
Mar 21, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVE-2022-41696
1Visam
1Vbase Automation Base
Jun 17, 2026
Mar 21, 2023
N/A· v4
5.5 MEDIUM· v3
N/A· v2
Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file.
CVE-2018-25082
1Wechat Sdk Python Project
1Wechat Sdk Python
Nov 21, 2024
Mar 21, 2023
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiate...Show more
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The patch is named e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.Show less
CVE-2023-27874
1Ibm
1Aspera Faspex
Jun 17, 2026
Mar 21, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Forc...Show more
IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845.Show less
CVE-2023-26461
1Sap
1Netweaver Enterprise Portal
Jun 17, 2026
Mar 14, 2023
N/A· v4
4.9 MEDIUM· v3
N/A· v2
SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to...Show more
SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50, allows an authenticated attacker with sufficient privileges to access the XML parser which can submit a crafted XML file which when parsed will enable them to access but not modify sensitive files and data. It allows the attacker to view sensitive data which is owned by certain privileges. Show less
CVE-2023-1288
13ds
1Enovia Live Collaboration
Jun 17, 2026
Mar 9, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.
CVE-2023-27476
1Osgeo
1Owslib
Jun 17, 2026
Mar 8, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`)...Show more
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. This issue has been addressed in version 0.28.1. All users are advised to upgrade. The only known workaround is to patch the library manually. See `GHSA-8h9c-r582-mggc` for details.Show less
CVE-2023-27480
1Xwiki
1Xwiki
Jun 17, 2026
Mar 7, 2023
N/A· v4
7.7 HIGH· v3
N/A· v2
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leadin...Show more
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with edit rights on a document can trigger an XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host. This vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1. Users are advised to upgrade. Users unable to upgrade may apply the patch `e3527b98fd` manually.Show less
CVE-2023-20052
3Cisco
ClamavStormshield
4Clamav
Secure EndpointSecure Endpoint Private Cloud+1 more
Jun 17, 2026
Mar 1, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier co...Show more
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process.Show less
CVE-2023-26043
1Geosolutionsgroup
1Geonode
Jun 17, 2026
Feb 27, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of Ge...Show more
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read. This issue has been patched in version 4.0.3. Show less
CVE-2023-24189
1Bstek
1Urule
Jun 17, 2026
Feb 24, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.
CVE-2023-20855
1Vmware
2Vrealize Automation
Vrealize Orchestrator
Jun 17, 2026
Feb 22, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsi...Show more
VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.Show less
CVE-2023-26267
1Php Saml Sp Project
1Php Saml Sp
Jun 17, 2026
Feb 21, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
php-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities was silently enabled via \LIBXML_DTDLOAD | \LIBXML_DTDATTR.
CVE-2015-10082
1Libimobiledevice
1Libplist
Nov 21, 2024
Feb 21, 2023
N/A· v4
9.8 CRITICAL· v3
5.2 MEDIUM· v2
A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external ent...Show more
A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.Show less
CVE-2016-15026
1Dd Plist Project
1Dd Plist
Nov 21, 2024
Feb 20, 2023
N/A· v4
7.8 HIGH· v3
4.3 MEDIUM· v2
A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approac...Show more
A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.Show less