CVE-2025-4639

CVE-2025-4639 affects Peergos up to version 1.1.0, due to CWE-611 (Improp er Restriction of XML External Entity Reference) in the WebDav servlet’s getDocumentBuilder() method. Multiple sources corroborate the issue in Peergos 1.1.0 and earlier, describing a vulnerability that can impact confident...

CVE-2025-4639 Improper Restriction of XML External Entity Reference in Peergos

CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder method of WebDav servlet in Peergos. This issue affects Peergos through version 1.1.0...

CVE-2025-4639 Improper Restriction of XML External Entity Reference in Peergos

CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder method of WebDav servlet in Peergos. This issue affects Peergos through version 1.1.0...

CVE-2025-47778

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has...

XML External Entity (XXE) Injection

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to the containsUnsafeContent method in the class SvgFileInspector. An attacker can achieve...

CVE-2025-47778 Sulu vulnerable to XXE in SVG File upload Inspector

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has...

CVE-2025-47778 Sulu vulnerable to XXE in SVG File upload Inspector

Sulu is an open-source PHP content management system based on the Symfony framework. Starting in versions 2.5.21, 2.6.5, and 3.0.0-alpha1, an admin user can upload SVG which may load external data via XML DOM library. This can be used for insecure XML External Entity References. The problem has...

firefox: thunderbird: Unsafe attribute access during XPath parsing

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A vulnerability was identified in Firefox where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access an...

VulnCheck KEV: CVE-2025-2777

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives...

PT-2025-21177 · Sulu · Sulu

Name of the Vulnerable Software and Affected Versions: Sulu versions 2.5.21 through 2.5.24 Sulu versions 2.6.5 through 2.6.8 Sulu versions 3.0.0-alpha1 through 3.0.0-alpha2 Description: Sulu is an open-source PHP content management system based on the Symfony framework. The issue allows an admin...

Alibaba Cloud Linux 3 : 0018: php:7.4 (ALINUX3-SA-2023:0018)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0018 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-21707: In PHP versions 7.3.x belo...

Alibaba Cloud Linux 3 : 0120: libxml2 (ALINUX3-SA-2024:0120)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0120 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-25062: An issue was discovered in libxml2...

PT-2025-21224 · Peergos · Peergos

Name of the Vulnerable Software and Affected Versions: Peergos versions through 1.1.0 Description: The issue is related to an improper restriction of XML external entity reference in the getDocumentBuilder method of the WebDav servlet in Peergos. This allows for potential exploitation...

PT-2025-21226 · Unknown · Bonigarcia Webdrivermanager

Name of the Vulnerable Software and Affected Versions: bonigarcia webdrivermanager versions 1.0.0 through 6.0.2 Description: The issue is related to an Improper Restriction of XML External Entity Reference, allowing Data Serialization External Entities Blowup. This affects the XML parsing...

Alibaba Cloud Linux 3 : 0255: expat (ALINUX3-SA-2024:0255)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0255 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-50602: An issue was discovered in libexpat...

Sulu 代码问题漏洞

Sulu is a Symfony framework on an extensible, PHP-based open source content management system from Sulu, Austria. A code issue vulnerability exists in Sulu versions 2.5.21, 2.6.5, and 3.0.0-alpha1, which stems from an administrator user uploading SVGs that could lead to insecure XML external enti...

Moderate: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

firefox: thunderbird: Unsafe attribute access during XPath parsing

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A vulnerability was identified in Firefox where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access an...

libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash...

Moderate: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...