EUVD-2026-38442

Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload processing that allows authenticated attackers to read arbitrary files. The application uses simplexmlloadstring without disabling external entity loading, enabling attackers to inject XXE payloads...

CVE-2026-40042

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax and inline tags in issue descriptions...

EUVD-2026-21569

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexmlloadstring without XXE protection. With LIBXMLNOENT flag, arbitrary server files can be read. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3...

CVE-2021-42194

The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...

PT-2018-14615

Name of the Vulnerable Software and Affected Versions Douchat version 4.0.4 Description An issue was discovered in Douchat due to the use of simplexml load string in Data/notify.php, which can lead to XXE and potentially be used for SSRF. Recommendations For Douchat version 4.0.4, consider...

PT-2011-4848

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.3.x through 3.3.10.4 phpMyAdmin versions 3.4.x through 3.4.7.0 Description The issue allows remote authenticated users to read arbitrary files via XML data containing external entity references, also known as an XML...