Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CVE-2024-34102

CVE-2024-34102 POC for CVE-2024-34102. A pre-authentication XML entity injection issue in Magento / Adobe Commerce. Overview This POC will attempt to read files from target hosts that are vulnerable to the recent Magento / Adobe Commerce CVE-2024-34102. This POC is based on this security advisory...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

Rocky Linux 8 [CIQ] Security Update: xmlrpc-c / xmlrpc-c-c++ / xmlrpc-c-c++-debuginfo / xmlrpc-c-client / etc (crlsa-2025_4048)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20254048 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2025_3913)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253913 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly from th...

Rocky Linux 9 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2025_7444)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257444 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly from th...

Rocky Linux 9 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2025_3531)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20253531 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly from th...

Rocky Linux 8 [CIQ] Security Update: qt5-qtwebsockets / qt5-qtwebsockets-debuginfo / etc Multiple Vulnerabilities (crlsa-2020_4690)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204690 advisory. qt: XML entity expansion vulnerability CVE-2015-9541 qt5-qtwebsockets: websocket implementation allows only limited size for frames and messages therefore...

Rocky Linux 10.0 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2025_7512)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20257512 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2025:1741291038)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741291038 advisory. - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via...

Telerik UI for ASP.NET AJAX 2009.1.314 < 2026.2.708 LayoutBuilder XXE DoS

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2009.1.314 or later and prior to 2026.2.708. It is, therefore, affected by a denial of service vulnerability. The internal LayoutBuilder control processes client-state XML without disabling DTD processing,...

CentOS Linux 6 [TuxCare] Security Update: libxml2 / libxml2-devel / libxml2-python / libxml2-static Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777464764)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777464764 advisory. - A flaw in libxml2 allows remote XML entity inclusion with default parser flags i.e., when the caller did not request entity...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

CVE-2025-27136

CVE-2025-27136 Exploiting an XML External Entity XXE Vulnerability. Use XML Payload to Grab Sensitive Files PoC test.xml Use curl to upload test.xml from our local machine to the bucket. curl -X PUT http://127.0.0.1:PORT/TB1 -H "Content-Type: application/xml" -d @test.xml Trigger the Exploit & Gr...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

CVE-2026-92001

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' due to...

EUVD-2026-85174

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001 Apache Sling XSS: Missing parser resource limits

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-92001 Apache Sling XSS: Missing parser resource limits

Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...