Linux Distros Unpatched Vulnerability : CVE-2023-4218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse IDE versions 2023-09 4.29 some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil...

libxml2 安全漏洞

libxml2 is a GNOME open source library for parsing XML documents. It is written in C and can be called by many languages, such as C, C++, and XSH. A security vulnerability exists in libxml2 version 2.9.14 and earlier, which stems from an uncontrolled recursion in XPath evaluation that could lead ...

Linux Distros Unpatched Vulnerability : CVE-2018-1000548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Umlet version 14.3 contains a XML External Entity XXE vulnerability in File parsing that can result in disclosure of confidential data, denial of service, serve...

Linux Distros Unpatched Vulnerability : CVE-2025-48994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared...

CVE-2025-54251

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access...

CVE-2025-54251 Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access...

CVE-2025-54251

Affected product : Adobe Experience Manager (AEM) ≤ 6.5.23.0. Vulnerability type : XML Injection that can bypass security features. Root cause / vector : Unspecified in the CVE entry, but the Nuclei template and related notes describe an XML injection that allows manipulation of XML queries and c...

CVE-2025-54251 Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access...

EUVD-2025-27380

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access...

Security Bulletin: SSRF Vulnerability in Logback's SaxEventRecorder via Malicious DOCTYPE in XML Configuration (Versions 0.1–1.3.14, 1.4.0–1.5.12) affects watsonx.data

Summary Server-Side Request Forgery SSRF in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML. The attacks involves the modification of DOCTYPE declaration in X...

CVE-2025-10183 XML External Entity Injection in TecConnect 4.1

A blind XML External Entity XXE injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCo...

CVE-2025-10183

CVE-2025-10183 describes a blind XML External Entity (XXE) injection in the OpenMessaging webservice of TecCom TecConnect 4.1, allowing an unauthenticated attacker to exfiltrate arbitrary files to a controller server. Affected: TecConnect 4.1 OpenMessaging webservice; root cause is XXE in OpenMes...

CVE-2025-24404

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat incubatin...

CVE-2025-24404

Apache HertzBeat (incubating) before 1.7.0 is affected by an XML Injection RCE vulnerability that occurs when an authenticated attacker adds a monitor that parses an XML sitemap response and returns specially crafted content. The issue can lead to remote code execution and impacts confidentiality...

CVE-2025-24404 Apache HertzBeat (incubating): RCE by parse http sitemap xml response

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat incubatin...

PT-2025-36738

Name of the Vulnerable Software and Affected Versions: TecCom TecConnect version 4.1 Description: The OpenMessaging webservice in TecCom TecConnect version 4.1 contains a blind XML External Entity XXE injection. This allows an unauthenticated attacker to exfiltrate arbitrary files to an...

PT-2025-36780

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.23.0 and earlier Description The issue concerns an XML Injection flaw in Adobe Experience Manager. Exploitation may allow a remote attacker to bypass security features and gain unauthorized write access. T...

PT-2025-36719

Name of the Vulnerable Software and Affected Versions: Apache HertzBeat versions prior to 1.7.0 Description: An XML injection Remote Code Execution RCE vulnerability exists in Apache HertzBeat due to parsing of HTTP sitemap XML responses. An attacker with authenticated access can trigger the...

Adobe Experience Manager 安全漏洞

Adobe Experience Manager is a content management solution from Adobe designed to help organizations efficiently create, manage and deliver cross-channel content while integrating business solutions to enhance the customer experience. An XML entity injection vulnerability exists in Adobe Experienc...

CVE-2025-10092

A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack can be executed remotely. The exploit h...