XXEinjector

XXEinjector XXEinjector automatisiert das Abrufen von Dateien mit direkten und Out-of-Band-Methoden. Die Verzeichnisauflistung funktioniert nur in Java-Anwendungen. Für andere Anwendungen muss die Brute-Force-Methode verwendet werden. Optionen: --host Erforderlich - Unsere IP-Adresse für...

xxexploiter

XXExploiter यह XML पेलोड उत्पन्न करता है, और आवश्यक DTD की सेवा या डेटा एक्सफिल्ट्रेशन के लिए स्वचालित रूप से एक सर्वर शुरू करता है। स्थापना install node and npm if you don't have it yet npm install -g xxexploiter स्रोत से निर्माण और चलाना यह एक साधारण Node एप्लिकेशन है जो TypeScript में लिखा गया...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. id: CVE-2022-38840 info: name: Güralp MAN-EAM-0003 3.2.4 - XML External Entity XXE author: daffainfo severity: high description: |...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

Apache OFBiz - XML External Entity Injection

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

VMWare Cloud Foundation NSX-V - XML External Entity (XXE)

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. id: CVE-2022-31678 info: name: VMWare Cloud...

CVE-2023-45612-PoC

CVE-2023-45612 PoC Este repositório contém uma prova de conceito PoC para a CVE-2023-45612, que permitia XXE na configuração padrão do ContentNegotiation no ktor. A PoC está dividida em 2 partes: server/, contendo um exemplo de um servidor Ktor usando uma versão afetada do Ktor, com um endpoint...

java-cve-2021-29425-tika-xxe

java-cve-2021-29425-tika-xxe...

CVE-2024-34102

CVE-2024-34102 ★ @th3gokul, Sanjaith3hacker, Chocapikk को मूल कोड बेस के लिए धन्यवाद। ★ विवरण CVE-2024-34102 : Adobe Commerce XXE भेद्यता विवरण: Adobe Commerce संस्करण 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 और पिछले संस्करण XML एक्सटर्नल एंटिटी रेफरेंस 'XXE' के अनुचित प्रतिबंध से प्रभावित हैं, जिसके...

Web-Security-Learning

Web-Security-Learning Endereço do projeto: https://github.com/CHYbeta/Web-Security-Learning Planeta do conhecimento Vulnerabilidades e Ataques: https://t.zsxq.com/mm2zBeq Índice: Web-Security-Learning Web Security Injeção SQL MySql MSSQL PostgreSQL MongoDB Técnicas Ferramentas XSS CSRF Outras...

fusionauth-samlv2

fusionauth-samlv2 Este repositório contém bindings SAML v2.0 em Java usando JAXB. Você usaria esta biblioteca para processar solicitações e respostas SAML. Consulte os testes para exemplos de código. Divulgações de segurança Se você encontrar uma vulnerabilidade ou outro bug relacionado à...

CVE-2019-2888

CVE-2019-2888 Vulnerabilidade XXE no WebLogic EJBTaglibDescriptor https://www.oracle.com/security-alerts/cpuoct2019.html fernflower.jar weblogic.jar/weblogic/servlet/ejb2jsp/dd/EJBTaglibDescriptor.class ╭─root@jas502n /var ╰─ find ./ |grep EJBTaglibDescriptor  ✔  8388  18:32:43...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Descrição da CVE No JetBrains Ktor antes da versão 2.3.5, a configuração padrão do ContentNegotiation com formato XML era vulnerável a XXE. A vulnerabilidade foi corrigida por @marychatte em 29 de setembro de 2023...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2775 info: name: SysAid On-Prem = 23.3.40 - XML External Entity...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

Apache Struts XWork - XML External Entity Injection

Apache Struts 2.0.0 2.2.1 and 2.2.1 = versions = 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input id: CVE-2025-68493 info: name: Apache Struts XWork - XML...