Monthly
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. The CVSS vector (AV:L/UI:R) confines the risk to local or social-engineering attack paths; no public exploit or CISA KEV listing has been identified at time of analysis.
XXE injection in Datavane TIS v5.0.0 exposes authenticated attackers a path to SSRF and out-of-band file exfiltration against the server hosting the application. The `doEditWorkflow` endpoint accepts a `taskScript` parameter parsed by an unhardened Java `DocumentBuilderFactory` that resolves external entities and loads external DTDs, allowing a crafted XML payload to trigger outbound HTTP requests to attacker-controlled infrastructure and read local files accessible to the TIS process user, including configuration files and Derby database credentials. No public exploit has been identified at time of analysis, but VulnCheck has published a dedicated advisory and the upstream patch commit is publicly accessible, providing clear technical signal about the vulnerable code path.
XML External Entity (XXE) injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to exfiltrate sensitive information by submitting crafted XML payloads to an XML-processing component on the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms low-complexity network exploitation requiring only a low-privileged account, with high confidentiality impact and no integrity or availability effect. No active exploitation has been confirmed (not in CISA KEV), and IBM has released a patch via its support portal.
XXE injection in Eclipse RDF4J exposes applications to local file disclosure and server-side request forgery when parsing untrusted XML-based RDF data or SPARQL query results. The root cause is an incomplete remediation of CVE-2018-1000644: while that earlier fix hardened some parser entry points, several XML parser interfaces remained unprotected against DOCTYPE declarations, external entity references, and external DTD loading. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the unauthenticated network vector (CVSS 4.0: 8.7, PR:N) means any application exposing RDF ingestion endpoints is at risk without upgrading to RDF4J 5.3.2.
XML External Entity (XXE) injection in UYAP Document Editor versions 4.5.17 through 5.4.17 allows a local attacker to exfiltrate sensitive file system contents by tricking a user into opening a specially crafted document. The vulnerability enables serialized data external linking via uncontrolled XML external entity resolution, resulting in high confidentiality impact with scope change to the underlying operating system. Reported by TR-CERT; no public exploit code or CISA KEV listing identified at time of analysis.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated remote file disclosure in Cisco BroadWorks stems from the OCI XML Parser permitting external entity resolution by default, allowing an attacker to read arbitrary filesystem files with the privileges of the BroadWorks process account. The affected component is the Open Client Interface - Provisioning (OCI-P) service, reachable over the network with no authentication or user interaction required, yielding a CVSS 7.5 score with C:H. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed as actively exploited by CISA KEV.
XML External Entity injection in Dell Command Update (DCU) versions prior to 5.7.1 enables a local attacker with low-privilege access to perform server-side request forgery and escalate privileges. The vulnerability stems from insufficient restriction of XML external entity references during DCU's XML parsing operations. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C) and high confidentiality impact confirm that exploitation crosses component boundaries, potentially exposing sensitive resources beyond DCU itself.
XML External Entity (XXE) injection in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote low-privileged authenticated attacker to read arbitrary files from the server or conduct server-side request forgery (SSRF), resulting in significant information exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms low-barrier network exploitation - any authenticated user can trigger the flaw with no interaction from other parties. No public exploit code or CISA KEV listing has been identified at time of analysis, though XXE exploitation techniques are universally understood and require no specialized tooling.
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. The CVSS vector (AV:L/UI:R) confines the risk to local or social-engineering attack paths; no public exploit or CISA KEV listing has been identified at time of analysis.
XXE injection in Datavane TIS v5.0.0 exposes authenticated attackers a path to SSRF and out-of-band file exfiltration against the server hosting the application. The `doEditWorkflow` endpoint accepts a `taskScript` parameter parsed by an unhardened Java `DocumentBuilderFactory` that resolves external entities and loads external DTDs, allowing a crafted XML payload to trigger outbound HTTP requests to attacker-controlled infrastructure and read local files accessible to the TIS process user, including configuration files and Derby database credentials. No public exploit has been identified at time of analysis, but VulnCheck has published a dedicated advisory and the upstream patch commit is publicly accessible, providing clear technical signal about the vulnerable code path.
XML External Entity (XXE) injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to exfiltrate sensitive information by submitting crafted XML payloads to an XML-processing component on the platform. The CVSS vector (AV:N/AC:L/PR:L) confirms low-complexity network exploitation requiring only a low-privileged account, with high confidentiality impact and no integrity or availability effect. No active exploitation has been confirmed (not in CISA KEV), and IBM has released a patch via its support portal.
XXE injection in Eclipse RDF4J exposes applications to local file disclosure and server-side request forgery when parsing untrusted XML-based RDF data or SPARQL query results. The root cause is an incomplete remediation of CVE-2018-1000644: while that earlier fix hardened some parser entry points, several XML parser interfaces remained unprotected against DOCTYPE declarations, external entity references, and external DTD loading. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the unauthenticated network vector (CVSS 4.0: 8.7, PR:N) means any application exposing RDF ingestion endpoints is at risk without upgrading to RDF4J 5.3.2.
XML External Entity (XXE) injection in UYAP Document Editor versions 4.5.17 through 5.4.17 allows a local attacker to exfiltrate sensitive file system contents by tricking a user into opening a specially crafted document. The vulnerability enables serialized data external linking via uncontrolled XML external entity resolution, resulting in high confidentiality impact with scope change to the underlying operating system. Reported by TR-CERT; no public exploit code or CISA KEV listing identified at time of analysis.