CVE-2024-34102

CVE-2024-34102 CVE-2024-34102 的 POC。Magento / Adobe Commerce 中的一个预认证 XML 实体注入问题。 概述 此 POC 将尝试从存在漏洞的、受近期 Magento / Adobe Commerce CVE-2024-34102 影响的目标主机读取文件。此 POC 基于此安全公告和 Assetnote 的研究。 使用方法 要运行此 POC，你需要一台拥有公开且可访问 IP 的机器。 此 POC 的功能 1. 创建一个包含主要 payload 的本地文件 poc.xml。 2. 通过 POST 请求将 payload 发送到目标。 ...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

Oracle Business Intelligence Publisher - XML External Entity Injection

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...

CVE-2024-34102

🇮🇱 BringTheHome NeverAgainIsNow 🇮🇱 我们要求安全返回所有被恐怖组织哈马斯劫持为人质的公民。在所有被绑架者获释并安全回家之前，我们不会休息。你可以帮助他们回家。https://stories.bringthemhomenow.net/ CVE-2024-34102 PoC 🚀 本仓库包含针对 Magento 中严重 XML 实体注入漏洞 CVE-2024-34102 的概念验证 PoC 漏洞利用程序。该漏洞允许外带敏感文件，进而可用于未授权访问 Magento 的管理功能。此漏洞利用程序仅用于教育目的，应负责任地使用。 概述 📖 Magento...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 我们要求安全归还所有被恐怖组织哈马斯劫持为人质的公民。在所有被劫持者获释并安全回家之前，我们不会停歇。你可以帮助他们回家。https://stories.bringthemhomenow.net/ CVE-2024-34102 PoC 🚀 本仓库包含针对 Magento 中严重 XML 实体注入漏洞（CVE-2024-34102）的概念验证（PoC）利用代码。该漏洞允许敏感文件的泄露，进而可被利用来获取对 Magento 管理功能的未授权访问。此利用代码仅用于教育目的，请负责任地使用。 概述 📖 Magento...

EUVD-2026-53441

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

CVE-2026-10025

IBM QRadar SIEM is affected by CVE-2026-10025 due to an XML External Entity (XXE) injection in the parseXmlPayload() function of the event processing pipeline (q1labs_core.jar). The vulnerability is triggered when XML-format property autodetection is enabled on at least one log source type and XM...

CVE-2025-36374

IBM DataPower Gateway is affected by CVE-2025-36374 due to an XML External Entity (XXE) vulnerability (CWE-611). The issue occurs when processing XML data and could allow a privileged user to expose sensitive information or exhaust memory. Affected products/versions include DataPower Gateway 10.6...

PYSEC-2026-1388 fonttools XML External Entity Injection (XXE) Vulnerability

Summary As of fonttools=4.28.2 the subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the...

PT-2026-53970

Name of the Vulnerable Software and Affected Versions IBM Business Automation Manager Open Editions versions 9.0.0 through 9.4.2 Description An XML external entity injection XXE occurs when processing XML data. This allows a remote attacker to expose sensitive information or consume memory...

CVE-2026-56701

Grav under 2.0.0-beta.2 is affected by an XML External Entity (XXE) vulnerability in SVG file upload handling. The issue arises because the application uses simplexml_load_string without disabling external entity loading, allowing authenticated attackers to inject XXE payloads via SVG files to ex...

CVE-2026-56701 Grav - XML External Entity Injection via SVG Upload

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexmlloadstring without disabling external entity loading, enabling attackers to inject XXE payloads...

CVE-2026-40991 XML External Entity (XXE) injection when documenting untrusted XML content

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

PT-2026-47710

CVE-2024-56123 - Microsoft Word XML External Entity Injection CVE ID :CVE-2024-56123 Published : June 8, 2026, 10:16 a.m. | 44 minutes ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more details,...