Security Bulletin: IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability (CVE-2025-12531)

Summary An XML external entity injection XXE vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-12531 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote...

CVE-2025-11700

N-central versions 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure...

CVE-2025-11700 N-central Multiple XXE Injection Vulnerabilities

N-central versions 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure...

CVE-2025-11700

N-able N-Central is affected by CVE-2025-11700. Versions earlier than 2025.4 are vulnerable to an XML External Entity (XXE) injection, enabling information disclosure. Remediation: upgrade to version 2025.4 or later.

CVE-2025-64518

An XML External Entity XXE injection vulnerability was found in the CycloneDX Java core library’s XML validation step where the XML Validator was not configured securely. When a specially crafted CycloneDX BOM XML is validated, external XML entities can be processed XXE, allowing an attacker to...

CVE-2025-12732 WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorization check on the showsetting function in all versions up to, and including, 7.33. This makes it possible for authenticated attacker...

CVE-2025-12732

CVE-2025-12732 impacts the WordPress plugin “WP Import – Ultimate CSV XML Importer for WordPress” (versions

EUVD-2025-124494

Malicious code in nextjs-xml-yaml-fork npm...

EUVD-2025-120200

Malicious code in xml-non-blocking-unuk-sirius npm...

EUVD-2025-112680

Malicious code in husky-xml-dagda-redis npm...

Malicious code in radiant-vuetify-pulsar-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd5c4b7e2c2de1ea070292038e89f90d1b8687fb1eb1ead236ee6a082436ce7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eleventy-envconfig-xml-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b303cfab127f5de13e9ddbdc9cfbd359b52b49413136ffa41fc2ce9ad4d257 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-115324

Malicious code in chromedriver-xml-pegasus-changelog npm...

EUVD-2025-113185

Malicious code in global-csrf-xml-package npm...

Malicious code in subscription-xml-jasmine-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eabecc43d01c8587b8f2f53eb45388a9476cf274b7a7c45c565f45dddd21bef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122237

Malicious code in sass-loader-xml-altair-dotenv-safe npm...

Malicious code in husky-xml-kastra-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7f9c2bf1b1dde395f39bfb95800a0f14b8fd95f06ea2bbcea41cf3fddbcc839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120197

Malicious code in xml-relay-jupiter-ultra npm...

EUVD-2025-120323

Malicious code in xanadu-resolvers-xml-scripts npm...

Malicious code in grunt-xml-mira-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04e5a7b127a43b5290a63aad4f13783c26ae6574a23f418fa7d4576816cd8d11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...