CVE-2025-35112 Agiloft XML external entity local path traversal

Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal on the local system files. Users should upgrade to Agiloft Release 31...

CVE-2025-57704

Delta Electronics EIP Builder v1.11 is affected by a XML External Entity (XXE) processing vulnerability due to improper handling of XML entities during file parsing, causing information disclosure. The issue is described as a local, low-complexity vulnerability with user interaction required, pot...

SUSE SLES12: libqt4 / libqt4-32bit / libqt4-devel / libqt4-devel-doc / etc (SUSE-SU-2025:02968-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02968-1 advisory. - CVE-2021-45930: Fixed out-of-bounds write leading to DoS bsc1196654 - CVE-2023-32573: Fixed missing initialization of QtSvg QSvgFont...

Adobe Commerce/Magento XXE Vulnerability (APSB24-40)

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges 2.4.7 2.4.7-p1 Adobe Commerce / 2.4.6 2.4.6-p6 Adobe Commerce / 2.4.5 2.4.5-p8 Adobe Commerce / 2.4.4 2.4.4-p9 Adobe Commerce / 2.4.3 2.4.3-ext-8 Adobe Commerce / 2.4.2...

Linux Distros Unpatched Vulnerability : CVE-2022-41704

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16...

CVE-2025-29515

Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...

WordPress Google XML News Sitemap plugin plugin <= 0.02 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross Site Request Forgery CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin Google XML News Sitemap plugin versions = 0.02...

SUSE-SU-2025:02968-1 Security update for libqt4

This update for libqt4 fixes the following issues: - CVE-2021-45930: Fixed out-of-bounds write leading to DoS bsc1196654 - CVE-2023-32573: Fixed missing initialization of QtSvg QSvgFont munitsPerEm bsc1211298 - CVE-2023-32763: Fixed buffer overflow on QTextLayout during rendering of an SVG file...

Linux Distros Unpatched Vulnerability : CVE-2017-18926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - raptorxmlwriterstartelementcommon in raptorxmlwriter.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer,...

Linux Distros Unpatched Vulnerability : CVE-2017-15691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prio...

Linux Distros Unpatched Vulnerability : CVE-2017-9062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. CVE-2017-9062 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2016-7980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of...

Linux Distros Unpatched Vulnerability : CVE-2017-8315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse XML parser for the Eclipse IDE versions 2017.2.5 and earlier was found vulnerable to an XML External Entity attack. An attacker can exploit the...

Linux Distros Unpatched Vulnerability : CVE-2016-3720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XML external entity XXE vulnerability in XmlMapper in the Data format extension for Jackson aka jackson-dataformat-xml allows attackers to have unspecified impa...

PT-2025-34612 · D Link · Dsl-7740C

Name of the Vulnerable Software and Affected Versions: D-Link DSL-7740C version DSL7740C.V6.TR069.20211230 Description: An incorrect access control issue exists in the DELT file.xgi API endpoint of the D-Link DSL-7740C. This allows attackers to modify arbitrary settings within the device’s XML...

Linux Distros Unpatched Vulnerability : CVE-2016-7999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl paramet...

CVE-2025-29515

Incorrect access control in the DELTfile.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password...

Linux Distros Unpatched Vulnerability : CVE-2018-20005

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been found in Mini-XML aka mxml 2.12. It is a use-after-free in mxmlWalkNext in mxml- search.c, as demonstrated by mxmldoc. CVE-2018-20005 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2018-7751

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The svgprobe function in libavformat/img2dec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service Infinite Loop via a crafted XML file...

Linux Distros Unpatched Vulnerability : CVE-2018-11761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability...