CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Description of CVE In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE. The vulnerability was patched by @marychatte on Sep 29, 2023 https://github.com/ktorio/ktor/pull/3770...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟 🏷️ Basic Information CVE ID : CVE-2025-58360 Published : 📅 November 25, 2025 Last Modified : 📅 November 25, 2025 still fresh as of Nov 26 Vulnerability Type : XML External Entity XXE – CWE-611 Affected Software : GeoServer...

ktor-cve-2023-45612-poc

Proof-of-Concept уязвимости XXE в Ktor CVE-2023-45612 Краткое описание Воздействие: произвольный доступ к файлам через специально сформированный XML DTD с XXE-ссылкой. Корневая причина: небезопасный парсер XML-документов. Этот репозиторий содержит уязвимое приложение Ktor 2.3.4 , настроенное на...

CVE-2019-8997

CVE-2019-8997 Une vulnérabilité d'injection d'entité externe XML XXE dans le système de gestion console de BlackBerry AtHoc versions antérieures à 7.6 HF-567 pourrait permettre à un attaquant de lire potentiellement des fichiers locaux arbitraires depuis le serveur d'application ou d'effectuer de...

CVE-2021-29447

WordPress 5.6-5.7 - Аутентифицированный Автор+ XXE CVE-2021-29447 Использование Шаг 1. Запустите WordPress root@kitploit: $ make up-wp Шаг 2. Запустите веб-сервер атакующего root@kitploit: $ make up-mal Шаг 3. Создайте вредоносный WAV-файл Без npm wavefile Рекомендуется root@kitploit: $ echo -en...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

CVE-2025-58360

CVE-2025-58360 Рассматриваемая уязвимость — CVE-2025-58360 оценка CVSS: 8.2 — неаутентифицированная ошибка XML External Entity XXE, затрагивающая все версии до 2.25.5 включительно, а также версии с 2.26.0 по 2.26.1 включительно. Она исправлена в версиях 2.25.6, 2.26.2, 2.27.0, 2.28.0 и 2.28.1...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Minimal Verification Environment This project is used to verify CVE-2025-66516 XML External Entity Injection Vulnerability in Apache Tika. Vulnerability Description Apache Tika 3.2.1 and earlier versions, when parsing PDF files containing XFA forms, did not properly disable externa...

CVE-2019-14678

CVE-2019-14678: SAS XML Mapper의 XML 외부 엔티티XML External Entity 취약점 SAS XML Mapper 9.45에는 악의적인 공격자가 여러 방식으로 악용할 수 있는 XML 외부 엔티티XXE 취약점이 있습니다. 예로는 로컬 파일 읽기Local File Reading, 대역 외 파일 유출Out Of Band File Exfiltration, 서버 측 요청 위조Server Side Request Forgery, 잠재적 서비스 거부Denial of Service 공격 등이 있습니다. 이 취약점...

EUVD-2026-68654

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2023-45612-PoC

CVE-2023-45612 PoC Ce dépôt contient une preuve de concept PoC pour CVE-2023-45612 qui permettait une XXE dans la configuration par défaut de ContentNegotiation dans ktor. Le PoC est divisé en 2 parties : server/, contenant un exemple de serveur Ktor utilisant une version affectée de Ktor, avec u...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2776 info: name: SysAid On-Prem = 23.3.40 - XML External Enti...

Apache Struts XWork - XML External Entity Injection

Apache Struts 2.0.0 2.2.1 and 2.2.1 = versions = 6.1.0 contain an XML external entity injection caused by missing XML validation, letting attackers potentially disclose files or cause denial of service, exploit requires crafted XML input id: CVE-2025-68493 info: name: Apache Struts XWork - XML...

Linux Distros Unpatched Vulnerability : CVE-2026-17615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending ...

MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...

CVE-2021-29447

CVE-2021-29447 PoC This repository contains a Proof of Concept PoC exploit for the CVE-2021-29447 vulnerability, affecting WordPress 5.6 and 5.7 using PHP 8. The exploit demonstrates how an attacker, with the ability to upload files, can exploit an XML parsing vulnerability in the Media Library,...

CVE-2024-34102

Cosmic Sting: Эксплоататор CVE-2024-34102 Cosmic Sting — это инструмент на Go, предназначенный для эксплуатации CVE-2024-34102, уязвимости удаленного выполнения кода. Детали CVE-2024-34102 Adobe Commerce версии 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 и более ранние затронуты уязвимостью неправильного...

Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...

CVE-2026-55848

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

EUVD-2026-68018

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...