CVE-2026-22006-XSLT-Server-Side-Injection-via-xsl-script-

CVE-2026-22006 – Серверная инъекция XSLT через xsl:script Код программы Python + XSLT root@kitploit: xsltserver.py - Applies user-supplied XSLT to XML from lxml import etree from flask import Flask, request app = Flaskname @app.route'/transform', methods='POST' def transform: xml =...

CVE-2026-79771

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

AutoGenerateXalanPayload

AutoGenerateXalanPayload Introduction Il s'agit d'un outil de génération automatique de payload pour la vulnérabilité de débordement Xalan dans le JDK, basé sur la CVE-2022-34169. Ayant constaté que différents JDK nécessitent des payloads de débordement différents, cet outil de génération...

CVE-2026-79771

Nokogiri versions before 1.19.3 are affected by a memory leak in the XSLT Stylesheet transform method. The root cause is heap allocations leaking when Ruby strings containing null bytes are passed as transform parameters. An unauthenticated, network-based attacker can trigger this by supplying cr...

EUVD-2026-65529

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

CVE-2026-79771 Nokogiri before 1.19.3 Memory Leak via XSLT Transform

Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling...

EUVD-2025-210773

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt prior to 1.1.43 that contains two use-after-free vulnerabilities: CVE-2025-24855 use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt-node and CVE-2024-55549 use-after-free related to excluded result...

CVE-2025-71406

Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) containing two use-after-free vulnerabilities: CVE-2025-24855 (XPath context node leaked via xsltEvalXPathStringNs) and CVE-2024-55549 (related to excluded result prefixes/namespaces). Processing crafted XSLT can tri...

Magento-ver.-2.4.6

Название эксплойта: FireBear Studio Improved Import & Export ver. 3.8.6 для Magento 2.4.6 - XSLT Server Side Injection Дата: 2023-11-17 Автор эксплойта: tmrswrr Сайт вендора: FireBear Studio Ссылка на ПО: FireBear Studio Improved Import & Export Версия: FireBear Improved Import & Export ver. 3.8....

CVE-2019-25137-Version-Research

Исследование затронутых версий CVE-2019-25137 Обзор CVE-2019-25137 CVE-2019-25137 — это уязвимость XSLT-инъекции в Umbraco CMS. Уязвимость присутствует на веб-странице XSLT Extensive Stylesheet Language Transformations Visualizer. Уязвимый URI этой страницы:...

CVE-2022-34169

CVE-2022-34169 PoC Un PoC malléable et une solution pour le challenge SUpwn du SUCTF 2025. Basé sur ce problème du découvreur original Felix Wilhelm et cet article de blog thanat0s. Ce PoC essaie de moins s'appuyer sur des constantes codées en dur que les PoC existants. Si vous souhaitez envoyer ...

CVE-2026-56389

GNU Bison (a parser generator) is affected by an arbitrary command execution flaw during HTML report generation . A crafted grammar file can override the executable used for the XML-to-HTML transformation step via %define tool.xsltproc, which is accepted without restriction and passed directly to...

CVE-2026-55471

CVE-2026-55471 affects HAPI FHIR: org.hl7.fhir.utilities XsltUtilities.saxsonTransform overloads (XsltUtilities.saxonTransform) prior to 6.9.10. The root cause is the use of a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions, enabl...

PYSEC-2026-1520 LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

The HTMLSectionSplitter class in langchain-text-splitters is vulnerable to XML External Entity XXE attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse and lxml.etree.XSLT without any...

GHSA-2F55-G35J-5JMF HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

Summary org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform... overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory which sets ACCESSEXTERNALDTD="" and...

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform... overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory which sets ACCESSEXTERNALDTD="" and ACCESSEXTERNALSTYLESHEET="". Th...

CVE-2026-46683 Snappy: SSRF and local file read via the xsl-style-sheet option

Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.0, there is a SSRF and local file read vulnerability via the xsl-style-sheet option. This issue has been patched in version 1.7.0...

JLSEC-2026-577

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded...

JLSEC-2026-582 xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of...

xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes...

JLSEC-2026-580

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be...