EUVD-2026-118038

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML specification...

CVE-2026-66295

The saxy XML encoder (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because it writes the target and content of a processing instruction verbatim without validation or escaping. By including the sequence ?> in a target or content value, an attacker can prematurely terminate the ...