CVE-2021-29447

WordPress 5.6-5.7 - Authenticated Author+ XXE CVE-2021-29447 Using Step1. Run WordPress root@kitploit: $ make up-wp Step2. Run Attacker web server root@kitploit: $ make up-mal Step3. Generate malicious WAV file Without wavefile npm Recommend root@kitploit: $ echo -en...

Security Bulletin: IBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML data

Summary IBM webMethods Integration Server is vulnerable to an XML external entity injection XXE attack when processing XML data. CVE-2026-2310. Vulnerability Details CVEID:CVE-2026-2310 DESCRIPTION: IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when...

DEBIAN-CVE-2026-19614

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

CVE-2026-19614 XML External Entity (XXE) Injection in CyberELF NanoXML

The API is prone to XML external entity XXE injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3...

CVE-2026-19614

CVE-2026-19614 is an XML External Entity (XXE) injection vulnerability in the API of CyberELF NanoXML version 2.2.3 . The root cause is that XML external entity support is enabled by default , allowing an attacker to craft malicious XML input that references external entities. The CVSS 4.0 base s...

CVE-2026-71375

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2026-71375

Cosminexus Component Container by Hitachi is affected by an XML external entity (XXE) injection flaw, caused by improper restriction of XML external entity references. The vulnerability spans a wide range of versions from 09-00 through 09-00-18 up to 11-70-01 (each with specific fixed versions, e...

CVE-2026-71375 XXE Vulnerability in Cosminexus Component Container

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

EUVD-2026-72655

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2019-14678

CVE-2019-14678: XML External Entity in SAS XML Mapper SAS XML Mapper 9.45 has an XML External Entity XXE vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denia...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958

SAP Integration Suite contains an XML External Entity (XXE) vulnerability in certain internal components that do not sufficiently validate XML documents accepted from untrusted sources. An attacker with low privileges can submit crafted XML payloads containing malicious external entity declaratio...

EUVD-2026-72578

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

PT-2026-86999

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-0...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 Exploiter Cosmic Sting is a Go-based tool designed to exploit CVE-2024-34102, Remote Code Execution vulnerability. CVE-2024-34102 Detail Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

exploit-CVE-2023-38490

Kirby XML External Entity XXE - CVE-2023-38490 exploit Kirby 3.9.6 XML External Entity Exploit for CVE-2023-38490 / GHSA-q386-w6fg-gmgp. Exploitation demonstration Build and run the vulnerable demo app: root@kitploit: cd docker docker buildx build -t kirby-starterkit-3.9.5 . docker run -d --rm -p...

CVE-2023-45612-PoC

CVE-2023-45612 PoC This repository contains a proof of concept PoC for CVE-2023-45612 which allowed XXE in the default configuration of ContentNegotiation in ktor. The PoC is split into 2 parts: server/, containing an example of a Ktor server using an affected version of Ktor, with an endpoint...

AZL-99702 CVE-2026-86144 affecting package libxml2 2.11.5-10

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...

CVE-2026-86144

In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XMLPARSENONET flag, if without it a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or ...