CVE-2025-10183

CVE-2025-10183 describes a blind XML External Entity (XXE) injection in the OpenMessaging webservice of TecCom TecConnect 4.1, allowing an unauthenticated attacker to exfiltrate arbitrary files to a controller server. Affected: TecConnect 4.1 OpenMessaging webservice; root cause is XXE in OpenMes...

PT-2025-36738

Name of the Vulnerable Software and Affected Versions: TecCom TecConnect version 4.1 Description: The OpenMessaging webservice in TecCom TecConnect version 4.1 contains a blind XML External Entity XXE injection. This allows an unauthenticated attacker to exfiltrate arbitrary files to an...

CVE-2025-10092

A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit h...

CVE-2025-10092

A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit h...

CVE-2025-10092 Jinher OA XML Type xml external entity reference

A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit h...

CVE-2025-10092 Jinher OA XML Type xml external entity reference

A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit h...

CVE-2025-10091 Jinher OA XML Type xml external entity reference

A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote exploitation of the attack is possibl...

CVE-2025-10091

CVE-2025-10091 affects Jinher OA up to version 1.2. The vulnerability is located in the XML Handler component, specifically the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add, where manipulation enables an XML External Entity (XXE) reference. Remote exploitation is possibl...

PT-2025-36455

Name of the Vulnerable Software and Affected Versions: Jinher OA versions up to 1.2 Description: A vulnerability exists in Jinher OA that allows for xml external entity reference. The issue affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add...

PT-2025-36456

Name of the Vulnerable Software and Affected Versions: Jinher OA versions up to 1.2 Description: A vulnerability exists in Jinher OA that allows for XML external entity reference. The issue impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add with...

Langchain Community Vulnerable to XML External Entity (XXE) Attacks

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which can lead to sensitive informati...

GHSA-PC6W-59FV-RH23 Langchain Community Vulnerable to XML External Entity (XXE) Attacks

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which can lead to sensitive informati...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via insecure use of etree.iterparse parsing. An attacker can access sensitive information by submitting crafted XML payload with referencies to local files. Details XXE Injection is a type of attack...

PT-2025-35896

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain version 0.3.63 Description The EverNoteLoader component is susceptible to XML External Entity XXE attacks due to insecure XML parsing. This issue stems from the use of etree.iterparse without disabling external entity...

Linux Distros Unpatched Vulnerability : CVE-2017-12621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - During Jelly xml file parsing with Apache Xerces, if a custom doctype entity is declared with a SYSTEM entity with a URL and that entity is used in the body of...

Linux Distros Unpatched Vulnerability : CVE-2017-14949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only...

Linux Distros Unpatched Vulnerability : CVE-2025-54988

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Critical XXE in Apache Tika tika-parser-pdf-module in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External...

CVE-2025-57704

Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2025-4949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the...

Linux Distros Unpatched Vulnerability : CVE-2020-24379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection. CVE-2020-24379 Note that Nessus relies on the presence of the...