XML External Entity (XXE) Injection

cyclonedx-core-java is vulnerable to XML External Entity XXE injection. The vulnerability is due to an insecurely configured XML Validator, where external entity processing was not fully disabled during XML validation, allowing attackers to supply a crafted CycloneDX XML BOM that triggers externa...

Open Redirect

Liferay Portal is vulnerable to Open Redirect. The vulnerability is due to improper validation of the comliferaylayoutadminwebportletGroupPagesPortletredirect parameter in the page administration module, which allows an attacker to redirect users to arbitrary external URLs...

CVE-2025-40345

creationtimestamp| type| source ---|---|--- 2025-12-12 19:54:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7sukqmxzn2q 2026-01-21 22:46:10+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mcxqsbv2c225 2026-03-19 00:00:00+00:00| seen|...

CVE-2025-14572

creationtimestamp| type| source ---|---|--- 2025-12-12 19:46:05+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115708314532060478 2025-12-12 21:28:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7szsvwqbh2q 2026-01-12 21:03:47+00:00| published-proof-of-concept|...

Exploit for Improper Restriction of XML External Entity Reference in Geoserver

CVE-2025-58360: GeoServer XXE Lab Unauthenticated XML Ext...

CVE-2025-12783

creationtimestamp| type| source ---|---|--- 2025-12-12 08:26:03+00:00| seen| https://gist.github.com/Darkcrai86/36b2c37ade7d6cf2eaa2fa124cb9ac82...

CVE-2025-13891

creationtimestamp| type| source ---|---|--- 2025-12-12 08:09:14+00:00| seen| https://gist.github.com/Darkcrai86/116b7adf4b8afdb09631e0241d603a1e...

XXE (XML External Entity Injection) org.apache.tika:tika-core Dependency in Crowd Data Center and Server

This is a vulnerability in a non-Atlassian Crowd dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity XXE XML External Entity Injection vulnerability was introduced in versions 6.3.0, 6.3.1, 6.3.2, 7.1.0, and 7.1.1 of Crowd Data...

XXE (XML External Entity Injection) org.apache.tika:tika-core Dependency in Bamboo Data Center and Server

This High severity XXE XML External Entity Injection vulnerability was introduced in versions 9.6.1, 10.0.0, 10.1.0, 10.2.0, 11.0.0, and 12.0.0-rc3 of Bamboo Data Center and Server. This XXE XML External Entity Injection vulnerability, with a CVSS Score of 8.4 and a CVSS Vector of...

CVE-2025-66516: Detecting and Defending Against Apache Tika XXE Attack

...

Malicious code in iraza2-fca (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a7307c50f4f14642add677ac343109c8691dc3c5e67a0de88d27ed958e9593b The package iraza2-fca was found to contain malicious code. Source: ghsa-malware 5f0c32bd90ff347b69dae6471a8099e36ac566490bfa361193fc59f1c53785d4 Any...

MAL-2025-192555 Malicious code in cms_comp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7762e8867157bd05bfa8858e8f90ecd85ed0d6cf08c2435d264b9c61ad3420de The package cmscomp was found to contain malicious code. Source: ghsa-malware e58e38c37e8492486fd771954f0b1906c083a4dd5741600ca28a0bed5dd919a7 Any...

Exploit for Improper Restriction of XML External Entity Reference in Geoserver

CVE-ID How does this detection method work? How do...

CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

EUVD-2025-203018

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

CVE-2025-64781

CVE-2025-64781 affects Japan Total System GroupSession products (Free edition prior to 5.7.1, byCloud prior to 5.7.1, ZION prior to 5.7.1). The issue arises when the initial configuration sets the “External page display restriction” to Do not limit, allowing a specially crafted URL to redirect th...

CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 CVSS...