1559 matches found
Citrix StoreFront Server - XML External Entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. id: CVE-2019-13608 info: name: Citrix StoreFront Server - XML External Entity author: daffainfo severity: high description: | Citrix StoreFront Server before 1903, 7.15 LTSR...
VMWare Cloud Foundation NSX-V - XML External Entity (XXE)
VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. id: CVE-2022-31678 info: name: VMWare Cloud...
GeoServer WFS - XXE Processing Vulnerability
GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...
CVE-2023-4357-Chrome-XXE
Descrição da ferramenta Primeira EXP de arquivo único do mundo que explora a vulnerabilidade CVE-2023-4357 Chrome XXE, permitindo que invasores obtenham arquivos locais dos visitantes. A primeira EXP de arquivo único do mundo que explora a vulnerabilidade CVE-2023-4357 Chrome XXE, permitindo que...
jdbc-sqlxml-xxe
jdbc-sqlxml-xxe h2-jdbc CVE-2021-23463 https://github.com/h2database/h2database/issues/3195 SQLXML XXE脆弱性の再現。 mysql-jdbc CVE-2021-2471 SQLXML XXE脆弱性の再現。...
CVE-2023-20052
CVE-2023-20052 Exploit - Compilación Corregida Compilación de Docker corregida para CVE-2023-20052 vulnerabilidad XXE de ClamAV que realmente compila. Lo Que Estaba Roto El exploit original no compila en sistemas modernos: ❌ Errores de compatibilidad con OpenSSL 3.0 ❌ Errores de tipo incompleto d...
CVE-2022-2414
IT GenXMLExternalEntityExploit è uno script PoC per dimostrare lo sfruttamento di una vulnerabilità XML External Entity XXE. Lo script utilizza payload XML per leggere file sensibili da un server di destinazione. Può essere utile per test di sicurezza, penetration testing o scopi educativi...
XOE
XOE XXE आउट-ऑफ़-बैंड भेद्यता का आसानी से शोषण करें विवरण यह उपकरण एक xml फ़ाइल बनाता है जिसमें आपके द्वारा दर्ज किया गया ip और पोर्ट होता है और प्रतिक्रिया के लिए कनेक्शन सुनता है :D स्क्रीनशॉट...
EUVD-2026-57314
In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity XXE processing when parsing untrusted XML-based RDF data or query results, permitting DOCTYPE declarations, external entity references, and external DTD loading. This is due to an incomplete fix for...
EUVD-2026-57212
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17...
EUVD-2026-53856
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...
CVE-2026-65432
Apache CXF is affected by an XXE in WSDL/XSD import parsing. The hardened StaxUtils path disables DTDs and external entities only for the top-level WSDL, but imported documents (wsdl:import /xsd:import ) are handed to WSDL4J, which does not disable DOCTYPE declarations or external entities, so im...
CVE-2026-14304
In Eclipse Accessibility Tools Framework ACTF versions up to 1.6.0 including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0, it has been identified that an XML External Entity XXE vulnerability exists. If this vulnerability is exploited, a malicious...
XXE vulnerability in ivy-report
ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...
CVE-2026-50782
CVE-2026-50782 describes an XML External Entity (XXE) injection in Jinher OA C6. The vulnerability is located at the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint, where an unauthenticated attacker can submit a crafted XML payload to read arbitrary files from the se...
CVE-2026-14865 XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...
CVE-2026-48359
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially...
CVE-2026-48359 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to read sensitive files, potentially...
CVE-2026-47898 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser
Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net Lucene.Net.Analysis.Common library. This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes...
