CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Nous exigeons le retour en toute sécurité de tous les citoyens pris en otage par le groupe terroriste Hamas. Nous ne nous reposerons pas tant que chaque otage n'aura pas été libéré et ne sera pas rentré chez lui en sécurité. Vous pouvez aider à les ramener chez...

SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

Oracle Business Intelligence Publisher - XML External Entity Injection

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...

CVE-2024-34102

CVE-2024-34102 POC pour CVE-2024-34102. Un problème d'injection d'entité XML avant authentification dans Magento / Adobe Commerce. Overview Ce POC tentera de lire des fichiers à partir d'hôtes cibles vulnérables au récent CVE-2024-34102 de Magento / Adobe Commerce. Ce POC est basé sur cet avis de...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 Мы требуем безопасного возвращения всех граждан, взятых в заложники террористической группировкой ХАМАС. Мы не успокоимся, пока каждый заложник не будет освобождён и не вернётся домой в безопасности. Вы можете помочь вернуть их...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_6057)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226057 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (crlsa-2022_6058)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226058 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the CIQ...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

EUVD-2026-87109

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

CVE-2026-94108: Improper Restriction of XML External Entity Reference

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

PT-2026-95959

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.27 Description An XML external entity injection issue exists in the XML2array helper function. The function fails to properly disable entity loading when running on PHP versions before 8.0. This allows attackers to...