CVE-2020-11991

Apache Cocoon 2.1.12 is vulnerable to XML injection via the StreamGenerator when parsing user-supplied XML containing external entities. This can allow reading arbitrary files on the server. The connected template explicitly notes the issue and recommends upgrading to Apache Cocoon 2.1.13 or late...

CVE-2025-24783

Apache Cocoon (all versions) is vulnerable to an Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) . The root cause is that the PRNG used to generate continuation identifiers is seeded with the system startup time, making these identifiers insufficiently unpredictable. An attacker...