CVE-2020-4463

IBM Maximo Asset Management is vulnerable to Information Disclosure via XXE Vulnerability CVE-2020-4463 IBM Maximo Asset Management is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

CVE-2016-3141

CVE-2016-3141 1. Vulnerability Detail. Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service memory corruption and application crash or possibly have unspecified other impact by triggering a...

crack-0.1.8-fixed

= crack Really simple JSON and XML parsing, ripped from Merb and Rails. The XML parser is ripped from Merb and the JSON parser is ripped from Rails. I take no credit, just packaged them for all to enjoy and easily use. == note on releases Releases are tagged on github and also released as gems on...

x-stream__xstream_CVE-2020-26217_1-4-14-java77

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. MXParser is recommend for use as it will greatly improve the...

ruby-nmap

ruby-nmap Source Issues Documentation Description A Ruby API to nmap, the exploration tool and security / port scanner. Allows automating nmap and parsing nmap XML files. Features Provides a Ruby API for automating nmap. Provides a Parser for enumerating nmap XML scan files. Supports the full Nma...

overkill

Overkill Overkill is an exploit for a patched vulnerability affecting QNAP QTS. Due to the way QNAP discloses vulnerabilities, I'm unsure if this issue has a CVE or not. However, it was likely patched in November 2020 and April 2021. The n-day was "discovered" while doing diff analysis for...

CVE-2017-9805

CVE-2017-9805: Apache Struts 2 S2-052 RCE Analysis This repository contains technical details and a PoC Proof of Concept study regarding the XStream deserialization vulnerability in Apache Struts 2 S2-052. 📌 Vulnerability Information CVE Code: CVE-2017-9805 Vulnerability Type: Remote Code Executi...

CVE-2021-29447-PoC

CVE-2021-29447 Proof-of-Concept ╔═╗╦ ╦╔═╗ ║ ╚╗╔╝║╣────2021-29447 ╚═╝ ╚╝ ╚═╝ Written By Isa Ebrahim - 0xRar on January, 2023 ═══════════════════════════════════════════════════════════════════════════ Title: Wordpress XML parsing issue in the Media Library leading to XXE Affected versions: Wordpre...

libxml2-exploit

libxml2-exploit An example exploit for CVE-2017-7376 Install Download this repo and a vulnerable version of libxml2, e.g. v2.7.7: git clone https://github.com/brahmstaedt/libxml2-exploit.git cd libxml2-exploit wget https://github.com/GNOME/libxml2/archive/v2.7.7.zip unzip v2.7.7.zip mv...

ktor-xxe-poc

ktor-xxe-poc This is a proof-of-concept reproducing the security problem CVE-2023-45612. Versions Used Ktor: 2.2.3 xmlutil: 0.84.3 Java: 17.0.6 Gradle: 9.1.0 Python: 3.13.7 How to Run 1. Build and run the server: ./gradlew build ./gradlew run 2. Test the XXE payload : python test.py The server wi...

liblapith

Liblapith - a library for parsing Nessus results files Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Felix Ingram, felix dot ingram at nccgroup dot com http://www.github.com/nccgroup/liblaptith Released under LGPL. See LICENSE for more information Example import...

CVE-2026-20224---XXE-Injection-en-Cisco-Catalyst-SD-WAN-Manager

CVE-2026-20224 - Cisco Catalyst SD-WAN Manager XXE Injection ⚠️ DISCLAIMER THIS TOOL IS EXCLUSIVELY FOR EDUCATIONAL AND RESEARCH PURPOSES This exploit is intended exclusively for authorized red team operations, penetration testing, and security research on systems where you have explicit written...

expat_2_1_0_CVE-2024-28757

Expat, Release 2.1.0 This is Expat, a C library for parsing XML, written by James Clark. Expat is a stream-oriented XML parser. This means that you register handlers with the parser before starting the parse. These handlers are called when the parser discovers the associated structures in the...

UBUNTU-CVE-2026-16762

An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive denial of service. Exploitation requires only that the application parse attacker-influenced XML; no...

CVE-2026-16762

An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during parsing, making the application unresponsive denial of service. Exploitation requires only that the application parse attacker-influenced XML; no...

CVE-2022-2414-POC

CVE-2022-2414-POC Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. It does...."potentially" confirmed...

CVE-2024-34102

CVE-2024-34102 Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML...

MAL-006

MAL-006: XML External Entity in "Try It" in WSO2 ESB An error-based XML External Entity XXE attack was identified in the WSO2 ESB "Try It" tool. Why no CVE? The vendor replied that "Try it is recommended to be disabled in production" and no public disclosure was made. Requirements: This...

CVE-2026-115721

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...

EUVD-2026-109915

UNSUPPORTED WHEN ASSIGNED Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition. This issue affects all versions of Apache Vysper. Apache Vysper is an XMPP Jabber server library. As this project is retired, we do not plan to release a version...