Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthenticated attackers to inject arbitrary web scripts via the 'file_list' field type, which execute when a user views an injected page. Exploitation requires that an integrating plugin or theme has registered a file_list field on a publicly accessible front-end form or a user meta box; CMB2 by default does not expose such fields, so a stock installation is not vulnerable. No public exploit identified at time of analysis, and the assessed CVSS vector (AC:H) reflects the non-default configuration prerequisite, making real-world risk lower than the 7.2 base score suggests.
Unauthenticated stored cross-site scripting in the Newsletter plugin for WordPress through 9.4.0 allows remote attackers to inject JavaScript that executes when a victim renders the stored content. Attackers can reach the public subscription endpoint (na=sa) without a nonce, capability check, or CAPTCHA, place the payload in the 'np1' custom field, and bypass email-address validation by embedding the '{profile_1}' placeholder in the local part of the submitted address. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and this is a credible, moderately-high priority issue rather than an inflated high-CVSS score.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Stored cross-site scripting in the MW WP Form plugin for WordPress (all versions up to and including 5.1.7) lets an unauthenticated visitor persist arbitrary JavaScript into a site by submitting a crafted 'post_id' value to a public form. The plugin's CSRF gate (MW_WP_Form_Csrf) is a double-submit cookie check that any visitor can satisfy simply by loading the public form page first, so there is no meaningful barrier to storing the payload; the script then executes whenever a victim - potentially an administrator - later views the injected page. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N by the reporter; assessed as UI:R by our team), this is a genuine but moderate-priority issue rather than a drop-everything emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the GSpeech TTS - WordPress Text To Speech plugin (all versions up to and including 3.22.0) allows unauthenticated attackers to plant script content in a post's comment field that survives WordPress kses sanitization and only becomes executable when the plugin rewrites the rendered HTML at request time. Any visitor who subsequently loads the affected page can have attacker-controlled script run in their browser session, though exposure depends on the site accepting and auto-publishing unauthenticated comments and on GSpeech output being rendered on that page. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); exploitation requirements include the plugin being active and its output-buffer rewrite running on the page displaying the comment.
Stored cross-site scripting in the No External Links WordPress plugin (all versions up to and including 5.2.0) lets an unauthenticated remote attacker inject arbitrary web scripts through the Log URL handling of the /goto/{base64} redirect path, with the injected payload executing when a privileged user views the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2 HIGH), and per the independent assessment the attack is network-reachable and unauthenticated but is gated by a non-default prerequisite: the administrator must have enabled the 'Link Encoding: Base64' option, and the payload only fires once a victim later loads the poisoned page, such as an admin reviewing the plugin's log table. Sites running 5.2.0 or earlier without Base64 link encoding enabled are not affected, and no public exploit code was identified at time of analysis.
Unauthenticated stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.2) lets remote attackers inject arbitrary JavaScript through the unsanitized 'data_type' parameter, which is persisted and then executes in the browser of any user who subsequently loads the affected board page. Exploitation is possible against any board left at the plugin's out-of-the-box defaults (write_level=0 for guest posting and editor_type=N), so newly created boards are vulnerable without any special configuration; the main limiting factor is that a victim must later view the injected page for the script to fire. No public exploit code or confirmed active exploitation has been identified at time of analysis, and while the CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) makes this a genuine elevated-priority issue for sites running the affected plugin, it is not an emergency across the broader internet.
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin through 4.28.3 lets unauthenticated attackers submit comment content that is later rendered as executable markup in search-result excerpts, so scripts run in the browser of any visitor or administrator who views an affected excerpt page. Exploitation is conditional rather than universal: the site's 'Allowable tags in excerpts' option must be non-empty (for example the documented default example of <p><a><strong>), comment content must be indexed and displayed (relevanssi_index_comments enabled), and the injected tag name must be prefixed by an allowed tag name - allowed <a> permits injected <audio>, allowed <p> permits <picture> - because of a prefix-matching regex flaw that fails to require complete tag names. Wordfence rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while this assessment applies AC:H in recognition of the operator-configuration dependency; no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation.
Stored cross-site scripting (XSS) in the Customer Reviews for WooCommerce plugin for WordPress, all versions up to and including 5.122.0, allows unauthenticated remote attackers to inject malicious scripts via the Comment Author Name when the image attachment feature (ivole_attach_image) is enabled. The vulnerability arises from insufficient input sanitization and output escaping, and the payload executes when a victim (such as an administrator viewing the reviews list table or a site visitor) loads the affected page. No public exploit code has been identified at time of analysis, but the CVSS 7.2 rating reflects the scope change and low confidentiality/integrity impact; exploitation is conditional on the non-default attachment setting being active.
Stored cross-site scripting in the DoFollow Case by Case WordPress plugin (all versions up to and including 3.6.0) allows unauthenticated attackers to inject arbitrary JavaScript through the public comment content field, with the payload persisting and executing in the browser of every subsequent visitor to the affected post once an administrator approves the comment. Exploitation requires the site to have public comment submission enabled and depends on a moderation workflow that approves the tainted comment - no attacker authentication is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and impact is bounded to script execution in victims' browsers with no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but moderate-priority issue whose practical risk is dictated by how permissive a site's comment moderation is.
Stored cross-site scripting in Relevanssi Premium through 2.31.4 lets unauthenticated attackers inject arbitrary web scripts through the '_rt' parameter when the plugin's click-tracking and logging feature is enabled. A valid _rt_nonce is publicly emitted on every search-results page, so the nonce does not stop unauthenticated exploitation, and the payload executes when a user later visits the injected page. No public exploit identified at time of analysis; exploitation requires the non-default click-tracking feature and is therefore not applicable to default-configuration sites.
Unauthenticated stored cross-site scripting in the Visitors Traffic Real Time Statistics Pro WordPress plugin (all versions up to and including 11.22) lets any logged-out visitor write raw HTML/JavaScript into the plugin's traffic database through the page_title parameter of the ahcpro_track_visitor AJAX action, which is deliberately exposed to unauthenticated callers via wp_ajax_nopriv_ahcpro_track_visitor. The injected script stays dormant in the ahc_title_traffic.til_page_title column until an administrator opens the plugin's dashboard, where the 'Traffic by Title' DataTable renders the stored value with innerHTML and no output escaping, executing attacker-controlled JavaScript inside the admin's authenticated session. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; because execution depends on a subsequent admin dashboard view, the attack is passive and deferred rather than immediate, placing it in the medium-priority tier despite the PR:N, UI:N base score of 7.2.
OS command injection in PeaZip before 11.3.0 allows an attacker to run arbitrary commands on a victim's machine by embedding a specially crafted filename in an archive, provided PeaZip is running in a specific non-default configuration. The root cause is mishandling of the 'quotation character already used in the string' condition, which lets the injected filename escape the application's quoting and reach the shell; the CVSS 4.0 vector records no required privileges (PR:N) but explicitly captures attack prerequisites (AT:P), and exploitation is local with user interaction, meaning the victim must open or process the malicious archive. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor has addressed it in PeaZip 11.3.0, and the independent assessment rates this moderate priority - worth patching, but not an emergency.
Stored cross-site scripting in LimeSurvey Community Edition 7.4.0 lets an authenticated user holding the global "Surveys: create" permission inject a JavaScript-breaking value into the date_min (and, per the vendor patch, date_max) attribute of a Date/Time question, which is then executed in the browser of any other user who renders that question. The payload does not fire at storage time: exploitation is gated on a separate victim actively viewing the affected survey, which is why the assessed CVSS 4.0 vector (PR:L, UI:A, AT:P) requires both a privileged authoring account and victim interaction. No public exploit code or confirmed in-the-wild exploitation is identified at time of analysis. Real-world exposure is concentrated in multi-user or multi-tenant deployments that delegate survey-creation rights to lower-trust users; instances where only trusted administrators can author surveys carry minimal risk.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
Second-order SQL injection in YesWiki before 4.6.7 allows a low-privileged authenticated user to read database contents and bypass read ACLs by self-registering an account whose username contains a double-quote SQL payload, which AclService::updateRequestWithACL later concatenates unescaped into the read-ACL LIKE clause when a non-admin ACL-filtered listing is loaded. Exploitation requires the instance to permit account self-registration and to accept a username carrying the payload, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L vector, so instances with self-registration disabled or with strict username validation are substantially harder to attack, and no victim interaction is needed. Although the vendor has released a fix in 4.6.7, no public exploit code has been identified at time of analysis; impact is confined to database read-out and read-ACL bypass rather than write or remote code execution, making this a genuine but moderate-priority issue, not an emergency.
Cross-site request forgery in YesWiki before 4.6.7 allows unauthenticated attackers to permanently delete arbitrary wiki pages (including their ACLs, links, triples, comments, and referrers) by luring a logged-in administrator or page owner to a crafted URL that invokes the ajaxdeletepage handler with a jsonp_callback parameter. The vulnerability requires user interaction (UI:P) and a privileged victim session, and it has no public exploit identified at time of analysis, though a vendor patch is available.
Authenticated users on YesWiki instances running versions prior to 4.6.7 can bypass ownership scoping in the triples delete API by submitting an empty filter, letting them delete or forge arbitrary semantic triples regardless of who owns them (CWE-863, CVSS 7.2). The most damaging abuse path removes the triple that records admins-group membership, emptying the administrator group and locking every administrator out of the site's authorization layer. The flaw is network-reachable and requires only a low-privilege authenticated account (CVSS PR:L) with no user interaction; no public exploit code has been identified at time of analysis, and the vendor has released a fix in 4.6.7.
CPU-exhaustion denial of service in Bouncy Castle for C# (bc-csharp) before 2.7.0 allows attackers who can get an application to decrypt a supplied encrypted private key to force an effectively unbounded PBKDF2 key-derivation workload, because the iteration count (near 2^31) is read directly from unauthenticated algorithm parameters and the key derivation runs before either the password or the ciphertext can be checked. The CVSS vector carries PR:N, so no credentials are required, but exploitation hinges on the victim choosing to load or decrypt the attacker's key material (UI:P) - realistically only services that ingest externally controlled PKCS#8 EncryptedPrivateKeyInfo objects, "ENCRYPTED PRIVATE KEY" PEM files, or CMS password recipients (CmsPbeKey) are exposed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is a moderate-severity availability issue rather than a confidentiality or integrity compromise; related PKCS#12 paths are tracked separately under CVE-2026-63572 (Pkcs12Store loading) and CVE-2026-63575 (zero/negative counts with PKCS#12 PBE algorithms).
CPU exhaustion denial of service in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 lets unauthenticated remote attackers tie up a process by supplying a crafted PKCS#12 (PFX) keystore. Pkcs12Store.Load and Pkcs12Utilities.ConvertToDefiniteLength take the key-derivation iteration count straight from the file - in MacData or in the PBE parameters of an encrypted SafeContents or shrouded key bag - without an upper bound, so a count approaching 2^31 forces enormous key-derivation work before the MAC or password is ever validated (PR:N per the assessed CVSS:3.1 vector). Exploitation is not autonomous: the assessed UI:R/UI:P condition means some victim application or user must actually accept and load the malicious keystore, so no public exploit code has been identified at time of analysis and there is no CISA KEV listing; this is a genuine but moderate-priority availability issue rather than remote code execution despite the 7.1 CVSS 4.0 score.
Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read arbitrary database entities through the GET /api/utm-network-scans/searchPropertyValues endpoint, including sensitive credential tables such as jhi_user. The flaw is reachable by remote attackers (CVSS:4.0 AV:N/PR:L, assessed equivalently as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), so exploitation is confined to malicious insiders or attackers who have already obtained a valid credential - no unauthenticated internet path or non-default configuration is required beyond an authenticated session. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis; the primary risk is direct confidentiality loss, not data integrity or availability, and vendor-released patch 11.2.16 is available.
Denial of service in the Java bindings of Apache Thrift (all versions before 0.25.0) allows an accepted protocol peer to exhaust server resources by triggering unbounded allocation while Thrift messages are received and parsed. Per the assessed CVSS vector (PR:L), the attacker must already be an authenticated or otherwise accepted client of the Thrift service rather than an anonymous internet actor, which materially narrows exposure for deployments that only accept connections from trusted peers. The impact ceiling is availability loss only - no data disclosure, integrity impact, or code execution is declared - and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the vendor-released fix is version 0.25.0.
Authenticated API key holders can read restricted issue contents and comments in Phproject (versions 1.1.6 through 1.8.6) because the REST API issue endpoints single_get, single_comments, and single_comments_post never invoke the allowAccess() authorization routine, silently bypassing the security.restrict_access confidentiality control. Attackers with any valid, active API key can retrieve restricted issues and comments - including owner and author email addresses - and post unauthorized comments to issues they should not be able to access. Exploitation requires the target instance to have 'Restrict issue access' enabled and a valid API key; no public exploit code has been identified at time of analysis, and impact is bounded to information disclosure plus limited unauthorized writes with no availability impact. Fixed in Phproject 1.8.7.
Denial of service in the Legion of the Bouncy Castle C# library (bc-csharp) before 2.7.0: Pkcs12Store.GetCertificateChain follows AuthorityKeyIdentifier issuer links without tracking already-visited certificates, so a crafted PKCS#12 file containing certificates that reference each other in a cycle drives the chain-building loop to run indefinitely, consuming CPU and memory until an OutOfMemoryException is thrown. Applications are affected only if they load an attacker-supplied PKCS#12 keystore and then request a key entry's certificate chain; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates no authentication is needed but some user or process interaction is required to feed in the malicious file, and the impact is confined to availability. No public exploit identified at time of analysis, and the upstream fix commit ships a crafted cyclic keystore as a regression test fixture rather than as released exploit tooling.
Improper authorization in MISP's correlation handling lets an authenticated user with at least read access to some events retrieve attribute values and event metadata from events they are no longer permitted to view, in deployments running MISP before v2.5.48. The leak occurs because correlation lookups are authorized against a point-in-time distribution snapshot stored on the correlation row, which carries no published flag, so the check diverges from the live event ACL once a correlated event is unpublished or moved to a different sharing group; the CVSS vector (PR:L) confirms the attacker must be authenticated, and no public exploit code has been identified at time of analysis. Impact is confined to confidentiality - read-only exposure bounded to those correlated events that were restricted after the correlation was created - making this a moderate-severity, measured-priority patch rather than an emergency.
Uncontrolled CPU consumption in Legion of the Bouncy Castle Inc.'s bc-csharp library before 2.7.0 lets an attacker who can supply a crafted PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, pin a CPU core for minutes at a time. The root cause is CWE-835, a loop with an unreachable exit condition: the PKCS#12 key-derivation loop in Pkcs12ParametersGenerator compared its counter with '!=' rather than '<', so an iteration count of zero or a negative value caused roughly 2^32 iterations to run before the MAC or password could ever be validated; a 75-byte PFX with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes. The impact is availability-only (CVSS 4.0 7.1, AV:N/AC:L/PR:N/UI:P, VA:H, with no confidentiality or integrity effect), so the flaw is an unauthenticated denial of service that depends on the victim application actually parsing attacker-controlled keystore data; only services that accept untrusted PFX/PKCS#8 input are realistically exposed, and no public exploit code was identified at time of analysis.
Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.
Improper input validation in MISP's decaying model import endpoint allows an authenticated user with the perm_decaying permission to overwrite, re-own, or re-flag decaying models belonging to other organisations in MISP versions before 2.5.48. The import handler strips only the top-level id and uuid fields and pins org_id/default on the outer array before saving the record flat, so a nested 'DecayingModel' key can smuggle its own primary key, organisation identifier, and default flag past those guards, letting an attacker modify an existing model in place, reassign its organisation, or set it as the organisation default and thereby alter scoring behaviour for other users. This is a bounded authorization/mass-assignment flaw rather than an unauthenticated critical: successful exploitation requires network access to the instance plus an account holding perm_decaying (not granted to ordinary users by default), and there is no confidentiality or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix commit (70e319e4b) exists.
Cross-site request forgery in YesWiki before 4.6.7 lets an attacker delete installed packages from a wiki instance by luring a logged-in administrator to a crafted link. The autoupdate UpdateAction processes state-changing deletions through unprotected GET requests - accepting action=delete together with a package parameter - with no anti-CSRF token check, so a request issued from an attacker-controlled page is executed with the administrator's session privileges. Deleting packages such as bazar strips functionality the site depends on, breaking core operation (CVSS 4.0 base 7.1; high availability impact, low integrity impact, no confidentiality impact). Exploitation is context-dependent: it requires a live administrator session in the victim's browser plus a lure/click, and no public exploit code has been identified at time of analysis.
Authenticated low-privilege users of YesWiki before 4.6.7 can bypass per-page write ACLs through the comments API editComment route (api/comments), overwriting arbitrary pages or comments and reparenting existing content by placing a victim page's identifier in the pagetag field. Because the route trusts the attacker-supplied key rather than validating it against the caller's write permissions, the flaw yields high integrity impact with limited availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) and requires only a valid account, so instances with open or self-service registration are most exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in YesWiki 4.6.7.
Unauthenticated user enumeration in YesWiki before 4.6.7 allows remote attackers to confirm registered email addresses by observing differing responses from the MotDePassePerdu lost-password recovery endpoint, which lacks rate limiting. This CWE-204 information disclosure does not expose credentials or account contents but enables targeted phishing and password-spraying campaigns. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 4.6.7.
An authenticated RPC client can crash a Zcash Foundation Zebra full node by calling the z_listunifiedreceivers RPC method with a crafted Unified Address whose Sapling receiver carries 43 bytes that fail Jubjub subgroup validation, triggering a reachable assertion (.expect()) that aborts the entire zebrad process because Zebra's release profile is built with panic = "abort". Affected releases are zebra-rpc through 7.0.0 and zebrad through 4.4.1 (fixed in zebra-rpc 8.0.0 and zebrad 4.5.0), and the request is repeatable on restart, so a node can be kept persistently offline. Exploitation requires the RPC server to be explicitly enabled via rpc.listen_addr and the attacker to authenticate - with the default enable_cookie_auth=true this generally implies local access to the .cookie file, making fully remote exploitation a non-default configuration - and no public exploit code was identified at time of analysis.
Improper access control in Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3 allows unauthenticated remote requests that should have been denied to be forwarded to backend systems the proxy is meant to protect, yielding high confidentiality and integrity impact on those subsequent systems (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Exploitation is conditional, not routine: the CVSS 4.0 vector carries AT:P, meaning a specific attack requirement outside the attacker's direct control must be satisfied before a request succeeds, and this is corroborated by the independent assessment as a genuine but conditional risk rather than an urgent emergency. No public exploit code or confirmed active exploitation was identified at time of analysis; fixed versions are 9.2.15 and 10.1.4, and this CVE supersedes CVE-2026-41920, whose record understated the 9.x affected range as 9.0.0-9.1.14.
Improper restriction of XInclude resource resolution in Copernik XML Factory through 0.1.1 allows an attacker-controlled XML document to resolve xi:include hrefs when the stock JDK provider is in use, resulting in local file disclosure and server-side request forgery against internal HTTP endpoints. Only applications that obtain a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory() (or harden an externally supplied XMLReader via XmlFactories.harden()), run without Apache Xerces (xercesImpl) on the classpath, explicitly enable XInclude with setXIncludeAware(true) or the equivalent reader feature, and parse XML from an untrusted source are affected; the Xerces provider and the Android provider are not affected. No CVSS vector, EPSS score, or CISA KEV entry was provided, so no public exploit or active exploitation was identified at time of analysis, although the defect is confirmed and fixed by upstream commits and the 0.1.2 release.