Apache Tika - XML External Entity Injection

Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1, and tika-parsers 1.13-1.28.5 contain an XML External Entity injection caused by processing crafted XFA files inside PDFs, letting attackers perform XXE attacks remotely, exploit requires crafted PDF input. id: CVE-2025-66516 info: nam...

GeoServer - XML External Entity Injection

GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity XXE injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input. id: CVE-2025-58360 info: name: GeoServer - XM...

Apache Struts XWork - XML External Entity Injection

Apache Struts 2.0.0 2.2.1 and 2.2.1 = versions = 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input id: CVE-2025-68493 info: name: Apache Struts XWork - XML...

Linux Distros Unpatched Vulnerability : CVE-2026-17615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending ...

MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

CVE-2021-29447

CVE-2021-29447 PoC このリポジトリには、WordPress 5.6 および 5.7 （PHP 8 使用時）に影響を与える CVE-2021-29447 脆弱性のための 概念実証（PoC） エクスプロイトが含まれています。このエクスプロイトは、アップロード権限を持つ攻撃者がメディアライブラリのXML解析の脆弱性を悪用し、XXE（XML External Entity）攻撃を引き起こし、結果としてターゲット環境からローカルファイルを外部に流出させる方法を示しています。 ⚠️ 免責事項 このプロジェクトは、教育、研究、および許可されたセキュリティテスト...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 エクスプロイター Cosmic Sting は、CVE-2024-34102（リモートコード実行の脆弱性）を悪用するために設計された Go ベースのツールです。 CVE-2024-34102 詳細 Adobe Commerce バージョン 2.4.7、2.4.6-p5、2.4.5-p7、2.4.4-p8 およびそれ以前は、XML 外部エンティティ参照（'XXE'）の不適切な制限の脆弱性の影響を受け、任意のコード実行につながる可能性があります。攻撃者は、外部エンティティを参照する巧妙に細工された XML...

exploit-CVE-2023-38490

Kirby XML External Entity XXE - CVE-2023-38490 エクスプロイト Kirby 3.9.6 XML External Entity CVE-2023-38490 / GHSA-q386-w6fg-gmgp のエクスプロイト エクスプロイトデモ 脆弱なデモアプリをビルドして実行: root@kitploit: cd docker docker buildx build -t kirby-starterkit-3.9.5 . docker run -d --rm -p 127.0.0.2:1337:80/tcp --name CVE-2023-384...

Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

EUVD-2026-68018

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

WSO2-2020-0731

WSO2-2020-0731: ثغرات XXE و XSS في WSO2 Carbon تم تحديد ثغرات XXE و XSS محتملة في العديد من منتجات WSO2. إفصاح البائع: يمكن العثور على إفصاح البائع وإصلاح هذه الثغرة هنا. لماذا لا يوجد CVE؟ لم يقم البائع ولا أنا بطلب CVE لهذه الثغرات. المتطلبات: تتطلب هذه الثغرة: إقناع مستخدم WSO2 شرعي بإضافة...

XXE-Payloads

XXE-Payloads Accesso rapido ai payload XXE XXE: root@kitploit: %sp;...

MAL-006

MAL-006: Entidade Externa XML em "Try It" no WSO2 ESB Um ataque de Entidade Externa XML XXE baseado em erro foi identificado na ferramenta "Try It" do WSO2 ESB. Por que não há CVE? O fornecedor respondeu que "é recomendado desabilitar o Try It em produção" e nenhuma divulgação pública foi feita...

PT-2026-83371

Name of the Vulnerable Software and Affected Versions mapfish-print versions prior to 3.28.30 mapfish-print versions prior to 3.30.32 mapfish-print versions prior to 3.31.24 mapfish-print versions prior to 3.33.16 mapfish-print versions prior to 4.0.5 Description MapFish Print fails to disable...

assertj-core security update

An update is available for assertj-core. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A rich and intuitive set of strongly-typed assertions to use for unit...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: apache-poi (UTSA-2026-093250)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093250 advisory. In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: obs-server (UTSA-2026-093681)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093681 advisory. A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain...

Moderate: Red Hat Security Advisory: assertj-core security update

An update for assertj-core is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...