PT-2025-30137 · Jinher Oa · Jinher Oa

Name of the Vulnerable Software and Affected Versions: Jinher OA version 1.2 Description: A vulnerability exists in Jinher OA 1.2 related to xml external entity reference within the ProjectScheduleDelete.aspx file. This issue can be exploited remotely. The exploit has been publicly disclosed...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from China Jinher Jinher Company. A code issue vulnerability exists in Jinher OA version 1.2, which stems from an incorrect operation of the file ProjectScheduleDelete.aspx resulting in an XML external entity reference...

Jinher OA 代码问题漏洞

Jinher OA is a collaborative management software from China Jinher Jinher Company. A code issue vulnerability exists in Jinher OA version 1.1, which stems from an incorrect operation of the file XmlHttp.aspx resulting in an XML external entity reference...

PT-2025-30138 · Jinher Oa · Jinher Oa

Name of the Vulnerable Software and Affected Versions: Jinher OA version 1.1 Description: A vulnerability exists in the processing of the XmlHttp.aspx file, leading to XML external entity reference XXE. This issue can be exploited remotely. The exploit has been publicly disclosed. Recommendations...

CVE-2025-52162

agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity XXE via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input...

XML External Entity (XXE) Injection

org.dspace, dspace-api is vulnerable to XML External Entity XXE injection. The vulnerability is due to improper handling of XML input during archive import and interaction with external services, which allows an attacker to craft malicious XML payloads that may lead to sensitive file disclosure o...

Agorum core open 安全漏洞

Agorum core open is an enterprise content management system from Agorum Germany. A security vulnerability exists in Agorum core open versions prior to 11.9.2 and prior to 11.10.1, which stems from improper handling of RSSReader endpoints and could lead to an attack by an XML external entity...

PT-2025-30070 · Unknown · Agorum Core Open

Name of the Vulnerable Software and Affected Versions: agorum core open versions 11.9.2 and 11.10.1 Description: The software contains an XML External Entity XXE issue via the RSSReader endpoint. Attackers can potentially access sensitive data by providing a crafted XML input. Recommendations: Fo...

CVE-2025-52162

agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity XXE via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input...

CVE-2025-52162

agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain an XML External Entity XXE via the RSSReader endpoint. This vulnerability allows attackers to access sensitive data via providing a crafted XML input...

CVE-2025-52162

Agorum core open versions v11.9.2 and v11.10.1 are vulnerable to an XML External Entity (XXE) injection via the RSSReader endpoint. The root cause is the improper handling of XML input, which allows an attacker to provide a crafted XML payload to access sensitive data . To mitigate this, users of...

CVE-2025-53621

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...

PT-2025-31426 · Dell · Dell Smartfabric Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions prior to 10.6.0.5 Description: Dell SmartFabric OS10 Software is susceptible to an Improper Restriction of XML External Entity Reference issue. A low privileged attacker with remote access could...

XML External Entity (XXE) Injection

org.apache.jackrabbit, jackrabbit-spi-commons, jackrabbit-core is vulnerable to XML External Entity XXE injection. The vulnerability is due to the use of an unsecured document builder to load privileges, which allows an attacker to exploit XXE and potentially access sensitive files or perform...

GHSA-JJWR-5CFH-7XWH DSpace is vulnerable to XML External Entity injection during archive imports

Impact Two related XXE injection possibilities have been discovered, impacting all versions of DSpace prior to 7.6.4, 8.2 and 9.1. 1. External entities are not disabled when parsing XML files during import of an archive in Simple Archive Format, either from command-line ./dspace import command or...

DSpace is vulnerable to XML External Entity injection during archive imports

Impact Two related XXE injection possibilities have been discovered, impacting all versions of DSpace prior to 7.6.4, 8.2 and 9.1. 1. External entities are not disabled when parsing XML files during import of an archive in Simple Archive Format, either from command-line ./dspace import command or...

XML External Entity (XXE) Injection

Overview org.dspace:dspace-api is a DSpace core data model and service APIs. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML parsing process during archive imports or when handling XML responses from upstream services. An attacker can access...

CVE-2025-53621

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...

CVE-2025-53621 DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...

CVE-2025-53621 DSpace vulnerable to XML External Entity (XXE) injection in import via Simple Archive Format (SAF) or import from external sources

DSpace open source software is a repository application which provides durable access to digital resources. Two related XML External Entity XXE injection possibilities impact all versions of DSpace prior to 7.6.4, 8.2, and 9.1. External entities are not disabled when parsing XML files during impo...