xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 악용 도구 Cosmic Sting은 원격 코드 실행 취약점인 CVE-2024-34102를 악용하도록 설계된 Go 기반 도구입니다. CVE-2024-34102 세부 정보 Adobe Commerce 버전 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 및 이전 버전은 임의 코드 실행으로 이어질 수 있는 XML 외부 엔터티 참조'XXE' 제한 오류 취약점의 영향을 받습니다. 공격자는 외부 엔터티를 참조하는 조작된 XML 문서를 전송하여 이 취약점을 악용할 수 있습니...

tinyxml

/ @mainpage TinyXML TinyXML은 다른 프로그램에 쉽게 통합할 수 있는 단순하고 작은 C++ XML 파서입니다. 기능 간단히 말해, TinyXML은 XML 문서를 파싱하여 읽고, 수정하고, 저장할 수 있는 DOMDocument Object Model을 구축합니다. XML은 "eXtensible Markup Language"의 약자입니다. XML을 사용하면 자신만의 문서 마크업을 만들 수 있습니다. HTML이 브라우저용 문서를 마크업하는 데 아주 훌륭한 역할을 하는 반면, XML은 예를 들어 일정 관리...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1780592184)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1780592184 advisory. - libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Note that Ness...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1780707176)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780707176 advisory. - libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Note that Ness...

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1780579806)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1780579806 advisory. - libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Note that...

SUSE CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

DEBIAN-CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

UBUNTU-CVE-2026-78253

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

CVE-2026-78253 Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

CVE-2026-78253 Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

CVE-2026-78253: Uncontrolled Recursion

Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted XML document...

Linux Distros Unpatched Vulnerability : CVE-2026-78253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in QXmlStreamReader::readElementText in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion...

EUVD-2026-78901

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-11864

IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 IF 001, 25.0.0 through 25.0.0 IF 005, 24.0.1 through 24.0.1 IF 008, and 24.0.0 through 24.0.0 IF 009 are affected by an XPath injection vulnerability. An authenticated attacker can use it to exfiltrate sensitive application data...

PT-2026-92141

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 Interim Fix 001 IBM Cloud Pak for Business Automation versions 25.0.0 through 25.0.0 Interim Fix 005 IBM Cloud Pak for Business Automation versions 24.0.1 through 24.0.1...

The vulnerability of the Document.createElement() function in the XML document access and manipulation module XMLDOM allows attackers to bypass existing security mechanisms and perform cross-site scripting (XSS) attacks.

The vulnerability of the Document.createElement function in the XML document access and management module, XMLDOM, is related to errors in processing XML requests. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and perform cross-site scripting attacks XSS...

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

AZL-103529 CVE-2026-75140 affecting package jsoup 1.11.3-4

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited...