CVE-2024-34102

CVE-2024-34102 POC for CVE-2024-34102. A pre-authentication XML entity injection issue in Magento / Adobe Commerce. Overview This POC will attempt to read files from target hosts that are vulnerable to the recent Magento / Adobe Commerce CVE-2024-34102. This POC is based on this security advisory...

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

CVE-2025-27136

CVE-2025-27136 Exploiting an XML External Entity XXE Vulnerability. Use XML Payload to Grab Sensitive Files PoC test.xml Use curl to upload test.xml from our local machine to the bucket. curl -X PUT http://127.0.0.1:PORT/TB1 -H "Content-Type: application/xml" -d @test.xml Trigger the Exploit & Gr...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

RHLW-2026-48331BCB39D8AC49 Lightwell Security Advisory: yamlbeans 1.13.0.rhlw-00005

Red Hat Lightwell has released com.esotericsoftware.yamlbeans:yamlbeans 1.13.0.rhlw-00005 with backported fixes for CVE-2023-24620 and CVE-2023-24621. CVE-2023-24620: An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

CVE-2026-124038

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

CVE-2026-124038 Uncontrolled XML entity expansion in the Flock Installer app for Android

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

CVE-2026-124038 Uncontrolled XML entity expansion in the Flock Installer app for Android

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

CVE-2026-124038

The Flock Installer app for Android (versions before 2.35.0 ) is vulnerable to an uncontrolled XML entity expansion (CWE-776). An attacker with a valid technician account who can control or impersonate the camera being set up can crash the application by returning a camera configuration response ...

EUVD-2026-121268

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

CVE-2026-124038: Flock Flock Installer app: An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows…

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

PT-2026-141779

An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on devices running Android 10, 11 or 12, by returning a came...

CVE-2026-119724

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend...

CVE-2026-119724 Apache JClouds: XML External Entity (XXE) in provider-response parsing

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend...

CVE-2026-119724

A flaw in Apache JClouds (all versions) allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML document. The root cause is the improper restriction of recursive entity references within Document Type Definitions (DTDs), which can lead to excessive consum...

EUVD-2026-115730

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend...

CVE-2026-119724: Apache Software Foundation Apache JClouds: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion')…

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend...

PT-2026-136064

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommend...