CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Descripción de CVE En JetBrains Ktor anterior a 2.3.5, la configuración predeterminada de ContentNegotiation con formato XML era vulnerable a XXE. La vulnerabilidad fue corregida por @marychatte el 29 de septiembre de 2023...

CVE-2023-20052

CVE-2023-20052 CVE-2023-20052 information leak vulnerability in the DMG file parser of ClamAV A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information o...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

ktor-cve-2023-45612-poc

Ktor XXE Vulnerability Proof-of-Concept CVE-2023-45612 Resumen Impacto: Acceso a archivos arbitrarios mediante una DTD XML manipulada con una referencia XXE. Causa raíz: Analizador XML inseguro. Este repositorio contiene una aplicación Ktor 2.3.4 vulnerable configurada para permitir entidades...

java-cve-2021-29425-tika-xxe

java-cve-2021-29425-tika-xxe...

CVE-2019-8997

CVE-2019-8997 Una vulnerabilidad de inyección de entidad externa XML XXE en el sistema de gestión consola de BlackBerry AtHoc en versiones anteriores a 7.6 HF-567 podría permitir a un atacante leer archivos locales arbitrarios del servidor de aplicaciones o realizar solicitudes en la red mediante...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress root@kitploit: $ make up-wp Step2. Run Attacker web server root@kitploit: $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend root@kitploit: $ echo -en...

xxexploiter

XXExploiter 它生成XML载荷，并自动启动一个服务器来提供所需的DTD或进行数据外泄。 安装 root@kitploit: install node and npm if you don't have it yet npm install -g xxexploiter 从源码构建和运行 这是一个用TypeScript编写的简单Node应用。因此你可以像构建其他应用一样构建它： （如果没有安装node和npm，请先安装它们） root@kitploit: npm install npm run build you may need to npm install typescrip...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2022-2414-Proof-Of-Concept

CVE-2022-2414-Proof-Of-Concept A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

fusionauth-samlv2

fusionauth-samlv2 Este repositorio contiene las implementaciones de SAML v2.0 en Java mediante JAXB. Usarías esta librería para procesar solicitudes y respuestas SAML. Consulta los tests para ver ejemplos de código. Divulgaciones de seguridad Si encuentras una vulnerabilidad u otro bug relacionad...

XXEinjector

XXEinjector XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options: root@kitploit: --host Mandatory - our IP address for reverse connections...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

Apache OFBiz - XML External Entity Injection

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

CVE-2025-58360

CVE-2025-58360 La vulnerabilidad en cuestión es CVE-2025-58360 puntuación CVSS: 8.2, una falla de entidad externa XML XXE no autenticada que afecta a todas las versiones hasta la 2.25.5 inclusive y desde las versiones 2.26.0 hasta la 2.26.1. Ha sido corregida en las versiones 2.25.6, 2.26.2,...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 最小化验证环境 本项目用于验证 CVE-2025-66516 （Apache Tika 中的 XML 外部实体注入漏洞）。 漏洞简介 Apache Tika 3.2.1 及其之前版本在解析包含 XFA 表单的 PDF 文件时，未正确禁用外部实体加载，导致存在 XXE 漏洞。攻击者可通过构造恶意的 PDF 文件读取服务器上的敏感文件。 环境要求 JDK 11+ Maven 使用方法 1. 生成恶意 Payload 运行 org.example.ExploitGenerator 类。 该程序会在当前目录下生成 poc-xxe.pdf。 Windows : 尝试读...