CVE-2025-8355

CVE-2025-8355 affects Xerox FreeFlow Core 8.0.4. It is an XML parsing XXE issue that enables SSRF by referencing internal URLs in crafted XML sent to jmfclient.jar. CVSS metrics point to HIGH impact with potential confidentiality exposure but no explicit code integrity/availability impact. Xerox ...

CVE-2025-8355 XXE leading to SSRF

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery SSRF...

CVE-2019-19144

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

CVE-2019-19144

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

Quantum DXi6702 安全漏洞

Quantum DXi6702 is a disk backup and deduplication appliance from Quantum Corporation, USA. A security vulnerability exists in the Quantum DXi6702 version 2.3.0.3, which stems from an XML external entity injection issue that could lead to information disclosure...

CVE-2019-19144

XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 11449-53631 Build304 devices via rest/Users?action=authenticate...

PT-2025-31644 · Quantum · Quantum Dxi6702

Name of the Vulnerable Software and Affected Versions: Quantum DXi6702 version 2.3.0.3 11449-53631 Build304 Description: An XML External Entity Injection issue exists in Quantum DXi6702 devices. The vulnerability is located in the /rest/Users?action=authenticate API endpoint. Recommendations: At...

CVE-2019-19144

CVE-2019-19144 applies to the Quantum DXi6702 disk backup appliance (firmware 2.3.0.3, build 304). The root cause is an XML External Entity (XXE) vulnerability in the REST endpoint at /rest/Users?action=authenticate, enabling external entities to be processed. This can lead to information disclos...

CVE-2025-26400

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

CVE-2025-26400

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...

SolarWinds Web Help Desk 代码问题漏洞

SolarWinds Web Help Desk is a suite of help desk and asset management software from US-based SolarWinds. The software supports centralized knowledge base, IT asset management, project and task management, and other features. A code issue vulnerability exists in SolarWinds Web Help Desk that...

PT-2025-31182 · Solarwinds · Solarwinds Web Help Desk

Name of the Vulnerable Software and Affected Versions: SolarWinds Web Help Desk affected versions not specified Description: SolarWinds Web Help Desk is susceptible to an XML External Entity XXE injection issue that may result in information disclosure. Successful exploitation requires valid,...

NewStart CGSL MAIN 7.02 : fonttools Vulnerability (NS-SA-2025-0156)

The remote NewStart CGSL host, running version MAIN 7.02, has fonttools packages installed that are affected by a vulnerability: - fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker...

Lantronix Provisioning Manager XML External Entity Injection Vulnerability

Lantronix Provisioning Manager is a software for gateway configuration and firmware updates from Lantronix USA. Lantronix Provisioning Manager suffers from an XML External Entity Injection vulnerability that arises from a network system or product that does not have the correct filters set to all...

ETQ Reliance CG 代码问题漏洞

ETQ Reliance CG is a quality management system from ETQ Corporation. A security vulnerability exists in ETQ Reliance CG that stems from the /resources/sessions/sso endpoint not disabling external entity parsing, which could lead to an XML external entity injection attack...

XML External Entity (XXE) Injection

org.apache.jackrabbit, jackrabbit-spi-commons, jackrabbit-core is vulnerable to XML External Entity XXE injection. The vulnerability is due to the use of an unsecured document builder to load privileges, which allows an attacker to exploit XXE and potentially access sensitive files or perform...

CVE-2025-53621 DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...

CVE-2025-53621

CVE-2025-53621 : DSpace prior to 7.6.4, 8.2, and 9.1 is vulnerable to XML External Entity (XXE) injection during archive imports (SAF) or when handling XML from upstream services. The issue arises because external entities are not disabled during XML parsing, enabling a trusted administrator to t...