Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

Tactis NoviGest Desktop App input validation error vulnerability

The Tactis NoviGest Desktop App versions prior to 8.0.0-300 contain an input validation error vulnerability. This vulnerability arises because the SAFT import functionality fails to properly disable external entity resolution when processing XML files controlled by users via JAXB Unmarshaller. As...

Apache Camel input validation error vulnerability

Security vulnerabilities exist in Apache Camel versions 4.0.0 through 4.18.5 and 4.19.0 through 4.22.2. These stem from the XQueryBuilder in camel-saxon, which uses the default Saxon Configuration to parse stream-based Source message bodies. No restrictions are placed on DOCTYPE declarations or...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.7.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation errors. This vulnerability stems from improper restrictions on external entities by the camel-smooks component. The default XML parser allows for the parsing of external...

Apache Camel input validation vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a vulnerability related to input validation. This vulnerability arises when the FopProducer creates a TransformerFactory by enabling only FEATURESECUREPROCESSING, without restricting access to external resources...

IBM MQ 9.1 < 9.1.0.38 LTS / 9.2 < 9.2.0.44 LTS / 9.3 < 10.0.0.5 CD / 9.3 < 9.3.0.42 LTS / 9.4 < 9.4.0.26 LTS (7284936)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7284936 advisory. - IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 throug...

Rocky Linux 9 [CIQ] Security Update: pki-acme / pki-base / pki-base-java / pki-ca / pki-kra / pki-server / etc (crlsa-2022_7326)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227326 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc (crlsa-2022_7470)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20227470 advisory. pki-core: access to external entities when parsing XML can lead to XXE CVE-2022-2414 Tenable has extracted the preceding description block directly from the CIQ...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Expat vulnerabilities (USN-8813-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8813-1 advisory. It was discovered that Expat did not correctly handle certain integer arithmetic...

USN-8813-1 expat vulnerabilities

It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411 It was discovered that Expat did not correctly track handler cal...

CVE-2026-61570

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

EUVD-2026-84820

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, MerlinReader creates a DocumentBuilder with default settings while parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database, leaving doctype...

CLEANSTART-2026-DL82237 Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities

Security vulnerability affects the wildfly package. Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8, various XML functions rely on the libxml global state to track configuration variables, such as whether external entities are loaded. This state is assumed to remain unchanged unless the user explicitly changes it by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002402)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002402 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, lik...

N-central - XML External Entities Injection

N-central versions %xxe; rand http: - raw: - | POST /dms/services/ServerUI HTTP/2 Host: Hostname Content-Type: text/xml Soapaction: "" soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope...

CVE-2026-55848 mapfish-print: XXE on MapFish Print allows reading arbitrary files of certain types

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-18715: Improper Restriction of XML External Entity Reference

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities...

PT-2026-71865

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can obtain sensitive information due to improper processing of XML external entities XXE. XXE is a type of attack where an application processes external entity referenc...

DEBIAN-CVE-2026-15803

In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...