Citrix StoreFront Server - XML External Entity

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. id: CVE-2019-13608 info: name: Citrix StoreFront Server - XML External Entity author: daffainfo severity: high description: | Citrix StoreFront Server before 1903, 7.15 LTSR...

Journyx - XML External Entities Injection (XXE)

The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources. id: CVE-2024-6893 info: name: Journyx - XML...

LabKey Server 19.1.0 - XML External Entity (XXE)

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-exportImage.view or visualization-exportPDF.view allows local files to be read. id: CVE-2019-9757 info: name: LabKey Server 19.1.0 - XML External Entity XXE author: ritikchaddha...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

VMWare Cloud Foundation NSX-V - XML External Entity (XXE)

VMware Cloud Foundation NSX-V contains an XML External Entity XXE vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure. id: CVE-2022-31678 info: name: VMWare Cloud...

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

Episerver 7 - Blind XML External Entity Injection

Episerver 7 patch 4 and earlier contains an XML external entity XXE caused by processing crafted DTD in XML requests involving util/xmlrpc/Handler.ashx, letting remote attackers read arbitrary files, exploit requires sending malicious XML payloads. id: CVE-2017-17762 info: name: Episerver 7 - Bli...

TablePress < 2.4.3 - XXE Injection

The PHPSpreadsheet library used by the plugin is affected by an XXE as the security scanner that prevents XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white spaces. On servers that allow users to upload their own Excel XLSX sheets, Server files...

GeoServer WFS - XXE Processing Vulnerability

GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...

SysAid On-Prem <= 23.3.40 - XML External Entity

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives. id: CVE-2025-2777 info: name: SysAid On-Prem = 23.3.40 - XML External Entity...

WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection

WSO2 API Manager 3.1.0 and earlier is vulnerable to blind XML external entity injection XXE. XXE often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access which allows the attacker to transmit...

Apache Cocoon 2.1.12 - XML Injection

Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. id: CVE-2020-11991 info: name: Apache Cocoon 2.1.12 - XML...

LumisXP <10.0.0 - Blind XML External Entity Attack

LumisXP aka Lumis Experience Platform before 10.0.0 allows unauthenticated blind XML external entity XXE attacks via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service. id:...

Apache OFBiz - XML External Entity Injection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CVE-2024-22120-RCE-with-gopher

Usage root@kitploit: python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime Summary This exploit was created to exploit an XXE XML External Entity. Through it, I read the backend code of the web service and found an endpoint where I could use gopher to make internal requests on...

cve-2025-54988-VulnTikaProject

Apache Tika Vulnerability Testing Project This is a Spring Boot application that uses Apache Tika 3.2.1 for document processing and text extraction. Prerequisites Have Docker Usage ./start-app.sh or docker compose up -d CVE execution Upload your malicious PDF...

CVE_2020_2546

Twitter: @Hktalent3135773 1、Weblogic RCE exploit CVE20202546 CVE-2020-2915 CVE-2020-2801 CVE-2020-2798 CVE-2020-2883 CVE-2020-2884 CVE-2020-2950 WebLogic RCE T3 payload exploit poc python3 2、exploit GIOP + send bind CVE-2020-2555、CVE-2019-2888、CVE-2019-2888 or others GIOP + send jta rmi or others...

CVE-2017-9822

CVE-2017-9822 DotNetNuke often abbreviated as DNN is a CMS Content Management System platform and web application framework based on Microsoft's ASP.NET technology. Key Information Affected Product: DotNetNuke DNN Platform – a popular .NET CMS/portal. Disclosure Date: July 2017. Severity: Critica...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...

CVE-2024-34102

CVE-2024-34102: Unauthenticated Magento XXE CVEHunter tool for vulnerability detection and exploitation tool for CVE-2024-34102 with Asychronous Performance. Installation root@kitploit: git clone https://github.com/th3gokul/CVE-2024-34102.git cd CVE-2024-34102 pip install -r requirements.txt...