WordPress Demo Importer Plus plugin <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload vulnerability

Authenticated Author+ Blind XML External Entity Injection via SVG File Upload vulnerability discovered by bosz in WordPress Plugin Demo Importer Plus versions = 2.0.9...

K000159609: Apache Tika vulnerability CVE-2025-66516

Security Advisory Description Critical XXE in Apache Tika tika-core 1.13-3.2.1, tika-pdf-module 2.0.0-3.2.1 and tika-parsers 1.13-1.28.5 modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same...

MiracleLinux 8 : postgresql-jdbc-42.2.3-3.el8 (AXSA:2020-847:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-847:03 advisory. postgresql-jdbc: XML external entity XXE vulnerability in PgSQLXML CVE-2020-13692 Tenable has extracted the preceding description block directly from the...

Exploit for Improper Restriction of XML External Entity Reference in Wordpress

CVE-2021-29447-PoC Overview CVE-2021-29447 is an XML Exte...

CVE-2025-14478

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

EUVD-2026-3148

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

CVE-2025-14478

The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection XXE in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in...

CVE-2025-14478

CVE-2025-14478 (Demo Importer Plus, WordPress) : The Demo Importer Plus plugin is vulnerable to XML External Entity (XXE) injection via SVG file uploads in all versions up to 2.0.9. Exploitation requires authentication at Author level or higher, and, in affected PHP configurations (older than 8.0...

WordPress Plugin Demo Importer Plus code issue and vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-3354

Name of the Vulnerable Software and Affected Versions Demo Importer Plus plugin for WordPress versions up to and including 2.0.9 Description The software is susceptible to XML External Entity Injection XXE through the SVG file upload functionality. This allows authenticated attackers with...

XXE (XML External Entity Injection) org.apache.tika:tika-parsers Dependency in Crowd Data Center and Server

This is a vulnerability in a non-Atlassian Crowd dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity XXE XML External Entity Injection vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. This XXE XML...

Apache Struts 2.x <= 2.3.37 / 2.5.x <= 2.5.33 / 6.x < 6.1.1 XML External Entity Injection in XWork (S2-069)

The version of Apache Struts installed on the remote host is 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, or 6.x prior to 6.1.1. It is, therefore, affected by an XML external entity injection XXE vulnerability in the XWork component: - Missing XML Validation vulnerability in Apache Struts, Apache...

MiracleLinux 4 : librsvg2-2.26.0-6.1.1.AXS4 (AXSA:2014-042:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-042:01 advisory. An SVG library based on cairo. Security issues fixed with this release: CVE-2013-1881 GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary fil...

MiracleLinux 4 : tomcat6-6.0.24-78.AXS4 (AXSA:2014-496:04)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-496:04 advisory. Description : Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages...

MiracleLinux 3 : php-5.1.6-43.0.1.AXS3 (AXSA:2014-315:01)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-315:01 advisory. PHP is an HTML-embedded scripting language that allows developers to write dynamically generated web pages. PHP is ideal for writing database-enabled...

MiracleLinux 4 : tomcat6-6.0.24-72.AXS4 (AXSA:2014-451:03)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-451:03 advisory. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Jav...

CVE-2022-50899

Geonetwork 3.10 through 4.2.0 contains an XML external entity vulnerability in PDF rendering that allows attackers to retrieve arbitrary files from the server. Attackers can exploit the insecure XML parser by crafting a malicious XML document with external entity references to read system files...

Security Bulletin: IBM i Access Client Solutions is vulnerable to an attacker carrying out an XML External Entity injection via a crafted XFA file inside of a PDF (CVE-2025-66516)

Summary IBM i Access Client Solutions is vulnerable to an attacker carrying out an XML External Entity injection via a crafted XFA file inside of a PDF CVE-2025-66516. Apache Tika is used by the Run SQL Scripts feature of IBM i Access Client Solutions to determine the content type of binary colum...