GHSA-MC43-4FQR-C965 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

Summary An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover,...

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

Summary An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover,...

Security Bulletin: Multiple Vulnerabilities in IBM WebSphere Application Server affect IBM Cloud Pak System

Summary Multiple Vulnerabilities in IBM WebSphere Application Server affect IBM Cloud Pak System. Vulnerability Details CVEID:CVE-2024-45071 DESCRIPTION: IBM WebSphere Application Server is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary...

PT-2025-24661 · Geoserver · Geoserver

Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.25.0 Description: An improper URI validation vulnerability exists in GeoServer, enabling an unauthorized attacker to perform XML External Entities XEE attacks and send GET requests to any HTTP server. By default,...

PT-2025-24681 · Keyoti · Searchunit

Name of the Vulnerable Software and Affected Versions: Keyoti SearchUnit versions prior to 9.0.0 Description: The issue allows an attacker to exfiltrate files from the underlying operating system by forcing a vulnerable host into parsing maliciously crafted XML and/or DTD files, exploiting an XML...

CVE-2025-44044

Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...

CVE-2025-44044

CVE-2025-44044 affects Keyoti SearchUnit prior to 9.0.0, which is vulnerable to XML External Entity (XXE). An attacker able to force the host to parse crafted XML/DTD can exfiltrate files from the underlying OS. The vulnerability’s practical consequence is unauthorized data disclosure via XML pro...

CVE-2025-44044

Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...

GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Summary GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. Impact This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. Th...

GHSA-826P-4GCG-35VW GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling

Summary GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity XXE exploit. Impact This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. Th...

CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through = 1.0.3...

CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through = 1.0.3...

CVE-2025-31039

CVE-2025-31039 affects the WordPress plugin Category Icon (affected: 1.0.2 and earlier). The issue is an improper restriction of XML External Entity Reference (XXE) that enables XML Entity Linking. According to the provided metrics, the CVSS base score is 9.1 (CRITICAL) with network access, low a...

CVE-2025-5877

A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml...

CVE-2025-5877

A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml...

CVE-2025-5877 Fengoffice Feng Office Document Upload ApplicationDataObject.class.php xml external entity reference

A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml...

CVE-2025-5877

The CVE-2025-5877 is a confirmed issue in Fengoffice Feng Office 3.2.2.1. It affects unknown functionality in /application/models/ApplicationDataObject.class.php within the Document Upload Handler, enabling an XML external entity reference. The vulnerability can be exploited remotely, and the exp...

The vulnerability of the Apache XML Graphics FOP transformation tool arises from improper restrictions on XML references to external objects, allowing attackers to execute XXE attacks.

The vulnerability of the Apache XML Graphics FOP transformation tool is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability allows a remote attacker to perform XXE attacks...

The vulnerability of the `com.ilient.agentApi.LshwAgent#doPost` method in the SysAid hardware and software support and control automation software allows attackers to perform XXE attacks.

The vulnerability of the com.ilient.agentApi.LshwAgentdoPost method in SysAid’s automation software for supporting and controlling hardware and software systems is related to incorrect restrictions on XML links to external objects during the processing of the /lshw endpoint. Exploiting this...

PT-2025-24673

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.27.1 GeoServer versions prior to 2.26.3 GeoServer versions prior to 2.25.7 GeoTools versions prior to 33.1 GeoTools versions prior to 32.3 GeoTools versions prior to 31.7 GeoTools versions prior to 28.6.1 GeoNetwo...