Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

CVE-2019-14678

CVE-2019-14678: XML External Entity in SAS XML Mapper SAS XML Mapper 9.45 has an XML External Entity XXE vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denia...

CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress $ make up-wp Step2. Run Attacker web server $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend $ echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00%remote;%init;%trick; \x00'...

CVE-2019-2888

CVE-2019-2888 WebLogic EJBTaglibDescriptor XXE Vulnerability https://www.oracle.com/security-alerts/cpuoct2019.html fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class ╭─root@jas502n /var ╰─ find ./ |grep EJBTaglibDescriptor  ✔  8388  18:32:43...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

CVE-2026-118975

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network...

EUVD-2026-124336

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Description of CVE In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE. The vulnerability was patched by @marychatte on Sep 29, 2023 https://github.com/ktorio/ktor/pull/3770...

CVE-2024-34102

CVE-2024-34102 ★ Thanks to @th3gokul, Sanjaith3hacker, Chocapikk for the original code base. ★ Description CVE-2024-34102 : Adobe Commerce XXE vulnerability description: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

CVE-2026-118975: Progress Software Telerik Reporting: In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references…

In Progress® Telerik® Reporting prior to version 20.3.26.1110, improper restriction of XML external entity references in the SVG processing engine allows an authenticated attacker with low privileges who can supply SVG content to a report to read local or UNC files, or trigger server-side network...

XXEinjector

XXEinjector XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options: --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file...

CVE-2025-58360

CVE-2025-58360 The vulnerability in question is CVE-2025-58360 CVSS score: 8.2, an unauthenticated XML External Entity XXE flaw that affects all versions prior to and including 2.25.5, and from versions 2.26.0 through 2.26.1. It has been patched in versions 2.25.6, 2.26.2, 2.27.0, 2.28.0, and...

CVE-2022-2414-Proof-Of-Concept

CVE-2022-2414-Proof-Of-Concept A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2026-91876

Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure...

EUVD-2026-123688

Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure...

CVE-2026-91876

Dell OpenManage Ansible Modules versions 2.0.4 through 10.0.3 are affected by an Improper Restriction of XML External Entity Reference vulnerability within the XML parsing component . A low privileged attacker with local access could exploit this flaw to cause information exposure . Remediation i...

CVE-2026-91876

Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure...

CVE-2026-105153

Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a craft...