JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. id: CVE-2020-4463 info: name: IBM Maximo Asset Management Information...

Oracle Business Intelligence Publisher - XML External Entity Injection

Oracle Business Intelligence Publisher is vulnerable to an XML external entity injection attack. The supported versions affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise BI Publishe...

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

Apache Cocoon 2.1.12 - XML Injection

Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML...

WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection

WSO2 API Manager 3.1.0 and earlier is vulnerable to blind XML external entity injection XXE. XXE often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access which allows the attacker to transmit...

Apache OFBiz - XML External Entity Injection

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figur...

Adobe Experience Manager ≤ 6.5.23.0 - XML Injection

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. id: CVE-2025-54251 info: name: Adobe Experience Manager ≤ 6.5.23.0 - XML Injection author: DhiyaneshDK,assetnote severity: medium description: |...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2775 info: name: SysAid On-Prem = 23.3.40 - XML External Entity...

Sitecore CMS - Cross-Site Scripting

Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack. id: CVE-2014-100004 info: name: Sitecore CMS - Cross-Site Scripting author: DhiyaneshDK severity: medium description: | Sitecore CM...

WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution

WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code executio...

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

CVE-2024-34102

CVE-2024-34102 POC per CVE-2024-34102. Un problema di iniezione di entità XML pre-autenticazione in Magento / Adobe Commerce. Panoramica Questo POC tenterà di leggere file da host target vulnerabili al recente CVE-2024-34102 di Magento / Adobe Commerce. Questo POC si basa su questo avviso di...

CVE-2018-11788

Sommario Apache Karaf è un contenitore applicativo moderno e polimorfo. È un contenitore leggero, potente e pronto per l'impresa, basato su OSGi. Apache Karaf è un "progetto prodotto", che fornisce un runtime completo e chiavi in mano. Il runtime è "multi-faccettato", il che significa che puoi...

geoserver-

Strumento di exploit per geoserver CVE-2024-36401 geoserver CVE-2024-36401 Ambiente: JDK8. Dichiarazione: solo per test autorizzati. L'utente è responsabile di ogni conseguenza derivante da un uso improprio; l'autore non è coinvolto. Si prega di rispettare leggi e regolamenti! 1、Payload...

CVE-2023-46604

CVE-2023-46604 Questo repository contiene uno script di exploit e un file XML Proof of Concept PoC per la vulnerabilità CVE-2023-46604 che colpisce Apache ActiveMQ. La vulnerabilità consente l'esecuzione remota di codice a causa di pratiche non sicure di deserializzazione all'interno del protocol...

tinyxml

/ @mainpage TinyXML TinyXML è un parser XML C++ semplice, piccolo e facilmente integrabile in altri programmi. Cosa fa. In breve, TinyXML analizza un documento XML e ne costruisce un Document Object Model DOM che può essere letto, modificato e salvato. XML sta per "eXtensible Markup Language". Ti...

Roundcube-CVE-2024-42008-and-CVE-2024-42010-POC

Prova di concetto: CVE-2024-42008 e CVE-2024-42010 Questa prova di concetto PoC dimostra lo sfruttamento di due vulnerabilità in Roundcube Webmail che consentono l'iniezione CSS e il cross-site scripting XSS. L'attacco consiste in due fasi: 1. XSS tramite allegato XML malevolo CVE-2024-42008 A...

POC-CVE-2025-66034

fontvarlib.py — CVE-2025-66034 fontTools varLib — Scrittura Arbitraria di File + Iniezione XML → Esecuzione Remota di Codice Indice Panoramica Dettagli della vulnerabilità Catena di attacco Requisiti Installazione Configurazione Utilizzo Come funziona Codice vulnerabile Checklist pre-sfruttamento...

ofbiz-CVE-2023-49070-RCE-POC

ofbiz-CVE-2023-49070-RCE-POC Este é um POC de RCE pré-autenticação para CVE-2023-49070 que afeta aplicações Apache ofbiz wget https://github.com/frohoff/ysoserial/releases/latest/download/ysoserial-all.jar POC de DNS POC de RCE Esses tweets me ajudaram muito:...