CVE-2025-49539 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information...

CVE-2025-49544

The CVE-2025-49544 entry concerns Adobe ColdFusion. Affected versions include 2025.2, 2023.14, 2021.20 and earlier. The root cause is an Improper Restriction of XML External Entity Reference (XXE), potentially leading to a security feature bypass. Impact described: a high-privileged attacker coul...

CVE-2025-49544 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

XML External Entity (XXE) Injection

llama-index-readers-papers Papers Loaders package is vulnerable to XML External Entity XXE Injection. The vulnerability is due to the sitemap parser accepting untrusted XML input without disabling entity expansion, allowing attackers to exhaust system memory and cause a denial of service...

Adobe ColdFusion code vulnerabilities

Adobe ColdFusion is a dynamic Web server platform maintained by Adobe. Adobe ColdFusion suffers from a code issue vulnerability that arises from improperly restricting XML external entity references, which can be exploited by an attacker to submit a special request, obtain sensitive information o...

Adobe ColdFusion code vulnerabilities

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion suffers from an XXE vulnerability that can be exploited by attackers to cause a securi...

PT-2025-28751 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference 'XXE' vulnerability. This could result in a security feature bypass, allowing a...

PT-2025-28742 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is related to an Improper Restriction of XML External Entity Reference 'XXE' that could result in a security feature bypass. An attacker could exploit this to...

Adobe ColdFusion code vulnerabilities

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has an XML external entity injection vulnerability that originates from improperly...

Exploit for CVE-2025-49493

CVE-2025-49493 Akamai CloudTest - XXE Injection ☁️ 📄 Descr...

PT-2025-67: XML external entity leads to Local File Read and Server-side request forgery in FastReport.NET

The vulnerability was identified in FastReport .NET, versions 2024.2.20. The discovered vulnerability, due to the ability to inject and expand external entities, can be exploited by an attacker to read arbitrary local files and perform server‑side request forgery SSRF with full response retrieval...

Malicious code in env-info-checker-kyy3w4fiurevd8uy43wfre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d6fb3feadb029e83e642c54a8ffc29782d65e981a2bd769dc972463231215b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ipmi-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ae45e03814e3e6804cac4e616877eecf2a0865d1ab813e7a2a273778899bc16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

LangChain HTMLSectionSplitter – XXE caused by unsafe XSLT parsing

This report is not public...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

Akamai CloudTest code-related vulnerabilities

Akamai CloudTest is a suite of scalable load testing platforms from Akamai, USA. A code issue vulnerability exists in Akamai CloudTest versions prior to 2025.06.02, which stems from XML external entity injection and may result in file inclusion...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection...

CVE-2025-49493

Akamai CloudTest before 60 2025.06.02 (12988) is affected by an XXE injection in SOAP endpoints (e.g., RepositoryService). The flaw can allow unauthenticated reading of local files; CVSS v3.1: 9.1. Remediation: upgrade to CloudTest 60 2025.06.02 (12988) or later, which disables external entity pr...

XML External Entity (XXE) Injection

Allure is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper XML parser configuration due to insecure settings in the xunit-xml-plugin that allow external entity expansion when processing .xml test result files...