CVE-2025-58360

CVE-2025-58360 The vulnerability in question is CVE-2025-58360 CVSS score: 8.2, an unauthenticated XML External Entity XXE flaw that affects all versions prior to and including 2.25.5, and from versions 2.26.0 through 2.26.1. It has been patched in versions 2.25.6, 2.26.2, 2.27.0, 2.28.0, and...

CVE-2019-10172

CVE-2019-10172 https://vulners.com/cve/CVE-2019-10172 No se conoce ninguna versión no vulnerable de este componente/paquete. Se recomienda investigar componentes alternativos o un posible control de mitigación. Mitigación 1. Deseable Intentar cambiar el uso de com.codehaus.jackson por...

CVE-2021-44228-Demo

CVE-2021-44228-Demo This project for prove and testing zero-day log4j exploit verify dependency ./mvnw dependency:list patch A set ENV LOG4JFORMATMSGNOLOOKUPS=true B add vm option -Dlog4j2.formatMsgNoLookups=true C.1 add properties log4j2.formatMsgNoLookups=true NOT WORK C.2 add properties...

CVE-2023-45612-PoC

CVE-2023-45612 https://nvd.nist.gov/vuln/detail/CVE-2023-45612 Descripción de CVE En JetBrains Ktor anterior a 2.3.5, la configuración predeterminada de ContentNegotiation con formato XML era vulnerable a XXE. La vulnerabilidad fue corregida por @marychatte el 29 de septiembre de 2023...

Blackash-CVE-2025-58360

🔓 🛰️ 'CVE-2025-58360' El endpoint WMS de GeoServer es vulnerable a un ataque XXE 🌟 🏷️ Información básica CVE ID : CVE-2025-58360 Publicado : 📅 25 de noviembre de 2025 Última modificación : 📅 25 de noviembre de 2025 aún fresco al 26 nov Tipo de vulnerabilidad : XML External Entity XXE – CWE-611...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789 Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

EUVD-2026-90762

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

ktor-xxe-poc

ktor-xxe-poc This is a proof-of-concept reproducing the security problem CVE-2023-45612. Versions Used Ktor: 2.2.3 xmlutil: 0.84.3 Java: 17.0.6 Gradle: 9.1.0 Python: 3.13.7 How to Run 1. Build and run the server: ./gradlew build ./gradlew run 2. Test the XXE payload : python test.py The server wi...

CVE-2025-12748

CVE-2025-12748 Eng Rus Credit: Svyatoslav Tereshin @TERESH1, Artem Mukhin @saladosss Issues: 687, 825 English Description An issue was discovered in the XML file processing procedure. The processing of the file's content is performed before the ACL check. This allows a user with limited permissio...

CVE-2026-20224---XXE-Injection-en-Cisco-Catalyst-SD-WAN-Manager

CVE-2026-20224 - Cisco Catalyst SD-WAN Manager XXE Injection ⚠️ DISCLAIMER THIS TOOL IS EXCLUSIVELY FOR EDUCATIONAL AND RESEARCH PURPOSES This exploit is intended exclusively for authorized red team operations, penetration testing, and security research on systems where you have explicit written...

Rocky Linux 10.2 [CIQ] Security Update: perl-XML-LibXML / perl-XML-LibXML-debuginfo / etc (crlsa-2026_39547)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639547 advisory. perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names CVE-2026-8177 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2024_5338)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245338 advisory. REXML: DoS parsing an XML with many s in an attribute value CVE-2024-35176 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: expat / expat-debuginfo / expat-debugsource / expat-devel (crlsa-2026_22721)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202622721 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 Tenable has extracted the preceding description block directly from the CIQ security advisory. Not...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1779122132)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779122132 advisory. - In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized...

CentOS Linux 8.5 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.5:CLSA-2026:1780592184)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1780592184 advisory. - libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. CVE-2026-41080 Note that Ness...

Rocky Linux 9 [CIQ] Security Update: perl-XML-LibXML / perl-XML-LibXML-debuginfo / etc (crlsa-2026_39553)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202639553 advisory. perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names CVE-2026-8177 Tenable has extracted the preceding description block directly...

Rocky Linux 9.6 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.6:CLSA-2026:1788370561)

"The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788370561 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version...