CVE-2026-121675

Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network...

EUVD-2026-122480

Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network...

CVE-2026-122985

Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network...

EUVD-2026-122130

Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network...

EUVD-2026-122127

Improper restriction of xml external entity reference in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information over a network...

CVE-2026-122196

Improper restriction of xml external entity reference in Microsoft Dynamics 365 on-premises allows an authorized attacker to disclose information over a network...

ROOT-APP-NPM-GHSA-4W3W-2RP5-G8JM GHSA-4w3w-2rp5-g8jm in @xmldom/xmldom - Patched by Root

Root has patched GHSA-4w3w-2rp5-g8jm in the @xmldom/xmldom package for Root:npm. Multiple fixed versions available...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object. id: CVE-2017-5983 info: name:...

VMWare Cloud Foundation NSX-V - XML External Entity (XXE)

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. id: CVE-2022-31678 info: name: VMWare Cloud...

Akamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)

Akamai CloudTest before 60 2025.06.02 12988 allows file inclusion via XML External Entity XXE injection. id: CVE-2025-49493 info: name: Akamai CloudTest 60 2025.06.02 - XML External Entity XXE author: xbow,3th1cyuk1 severity: critical description: | Akamai CloudTest before 60 2025.06.02 12988...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2775 info: name: SysAid On-Prem = 23.3.40 - XML External Entity...

XXEinjector

XXEinjector XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options: --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

[SECURITY] [DSA 6617-1] symfony security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6617-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 09, 2026 https://www.debian.org/security/faq -...

CVE-2026-120761

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...

EUVD-2026-119930

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...

CVE-2026-120761

Apache Axis2/Java versions through 2.0.1 are vulnerable to an Improper Restriction of XML External Entity Reference vulnerability. The root cause occurs when a client builds an AxisService from a WSDL URL using ServiceClient or AxisService.createClientSideAxisService with wsdl4j import resolution...

CVE-2026-120761

Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documents named by wsdl:import and xsd:impor...