CVE-2021-27931

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service...

Lumisxp Cross-Site Scripting Vulnerability

LumisXP is a cloud-based digital experience software from Lumis Inc. which helps users gain insight into various website, blog and landing page metrics on a unified platform. A security vulnerability exists in Lumisxp versions 15.0.x through 16.1.x, which stems from susceptibility to a cross-site...

LumisXP XML External Entity Injection Vulnerability

LumisXP is an application from the Portuguese company LumisXP. It provides a platform for managing customers. A security vulnerability exists in LumisXP versions prior to 10.0.0 that allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. An attack that exploits this...