Monthly
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
XML injection in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices allows an unauthenticated network attacker to push arbitrary Junos device configuration that the daemon then commits with root privileges, by serving a crafted XML response from a configured custom URL-feed server. Exploitation is not opportunistic: the SRX must be running UTM with a custom URL-category feed pointed at an attacker-influenced server, and the attacker must either control that feed server or be positioned to intercept and modify its response (a MITM), which is why the vendor's CVSS 4.0 score of 9.2 sits alongside an independent assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is total on exposed devices - full confidentiality, integrity and availability loss on the affected SRX - but no public exploit has been identified at time of analysis and there is no confirmed active exploitation. Treat it as a genuine high-priority issue rather than an inflated high-CVSS artifact, and prioritize any SRX running a custom URL-feed.
Blind XPath/XML injection in Adobe Experience Manager 6.5 (versions 6.5.0 through 6.5.25) allows a low-privileged, authenticated attacker to bypass security controls and read content they should not be able to access, with limited unauthorized write capability. The flaw is network-reachable, requires no user interaction, and carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact but only low integrity impact and no availability impact; the CVSS vector confirms the attacker must hold a valid low-privileged account (PR:L), so unauthenticated outsiders cannot exploit it directly. No public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published a vendor security bulletin (apsb26-152) covering the issue.
Blind XPath injection in the MediaWiki EasyTimeline (Timeline) extension lets an attacker who can submit <timeline> markup alter the extension's server-side XML/XPath query structure, potentially exposing data the wiki would not otherwise return. The flaw affects EasyTimeline before 1.46.1, 1.45.5, and 1.43.10; published scoring is severe (9.8, AV:N/AC:L/PR:N/UI:N) while independent assessment rates it as requiring edit privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because exploitation depends on being able to edit a page containing a <timeline> block - trivial on wikis that allow anonymous/open editing, but account- or role-gated where editing is restricted. Vendor-released patches exist (1.46.1 / 1.45.5 / 1.43.10), EPSS is low at 0.17% (6th percentile), and no public exploit identified at time of analysis.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session to corrupt data and degrade availability by feeding crafted input into the product's XML handling. The flaw is network-reachable (AV:N), needs no user interaction (UI:N), and leaves confidentiality untouched (C:N), with the full impact landing on integrity and availability (I:H/A:H); the practical exposure is narrowed because valid credentials are mandatory, the target is a specialized NVIDIA datacenter infrastructure component, and SSVC rates the issue non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis, EPSS places exploitation likelihood at roughly 0.5% (43rd percentile), and there is no CISA KEV listing - this is a genuine medium-to-high priority fix, not an emergency.
XML External Entity (XXE) injection in IBM webMethods Integration Server 11.1 allows an attacker with low-privileged access to submit malicious XML payloads that coerce the server's XML parser into disclosing sensitive filesystem contents or exhausting memory resources through recursive entity expansion. The vulnerability is confirmed by IBM with a patch available via advisory node/7286620. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType validation due to a multiline-flag inheritance bug in the PubidLiteral and SystemLiteral regex matchers: a publicId or systemId whose first line is a valid literal passes the check while ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) and breakout markup on subsequent lines are emitted verbatim into the <!DOCTYPE ...> declaration. This is a bypass of the mitigation introduced for the earlier DocumentType injection advisory; applications that treat requireWellFormed: true as a serialization-time security boundary against DOCTYPE injection are directly exposed. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.9.12.
XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) to bypass the requireWellFormed: true serialization guard and emit arbitrary markup verbatim into serialized XML output. The bypass exploits the multiline flag inherited by the QName_exact regex in lib/grammar.js, which causes the anchors to match at line boundaries rather than string boundaries - directly circumventing the strict-name validation introduced to close earlier injection advisories. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
XML injection in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series devices allows an unauthenticated network attacker to push arbitrary Junos device configuration that the daemon then commits with root privileges, by serving a crafted XML response from a configured custom URL-feed server. Exploitation is not opportunistic: the SRX must be running UTM with a custom URL-category feed pointed at an attacker-influenced server, and the attacker must either control that feed server or be positioned to intercept and modify its response (a MITM), which is why the vendor's CVSS 4.0 score of 9.2 sits alongside an independent assessed vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Impact is total on exposed devices - full confidentiality, integrity and availability loss on the affected SRX - but no public exploit has been identified at time of analysis and there is no confirmed active exploitation. Treat it as a genuine high-priority issue rather than an inflated high-CVSS artifact, and prioritize any SRX running a custom URL-feed.
Blind XPath/XML injection in Adobe Experience Manager 6.5 (versions 6.5.0 through 6.5.25) allows a low-privileged, authenticated attacker to bypass security controls and read content they should not be able to access, with limited unauthorized write capability. The flaw is network-reachable, requires no user interaction, and carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact but only low integrity impact and no availability impact; the CVSS vector confirms the attacker must hold a valid low-privileged account (PR:L), so unauthenticated outsiders cannot exploit it directly. No public exploit code or confirmed active exploitation was identified at time of analysis, and Adobe has published a vendor security bulletin (apsb26-152) covering the issue.
Blind XPath injection in the MediaWiki EasyTimeline (Timeline) extension lets an attacker who can submit <timeline> markup alter the extension's server-side XML/XPath query structure, potentially exposing data the wiki would not otherwise return. The flaw affects EasyTimeline before 1.46.1, 1.45.5, and 1.43.10; published scoring is severe (9.8, AV:N/AC:L/PR:N/UI:N) while independent assessment rates it as requiring edit privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) because exploitation depends on being able to edit a page containing a <timeline> block - trivial on wikis that allow anonymous/open editing, but account- or role-gated where editing is restricted. Vendor-released patches exist (1.46.1 / 1.45.5 / 1.43.10), EPSS is low at 0.17% (6th percentile), and no public exploit identified at time of analysis.
An authenticated, low-privileged user of ManageEngine OpManager or ManageEngine Firewall Analyzer (versions 12.8.709 and below) can abuse the 'Rule Tracking Compare Policies' feature to inject crafted XML that is parsed server-side, disclosing data beyond that feature's authorization boundary. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) reflects a network-reachable, low-complexity issue requiring only any valid console credential and no user interaction, with a scope change and high confidentiality impact but no integrity or availability impact, which confines the practical effect to information disclosure rather than code execution or service disruption. Because a session is required, the flaw is not pre-authentication exploitable; no public exploit code has been identified at time of analysis and no KEV listing was provided in the available intelligence, so exploitation appears to depend on an attacker first obtaining or holding a low-privilege console account with access to the affected feature.
XML injection in NVIDIA Infrastructure Controller for Linux (affected versions 0 through 1.9) allows an attacker who already holds a low-privilege authenticated session to corrupt data and degrade availability by feeding crafted input into the product's XML handling. The flaw is network-reachable (AV:N), needs no user interaction (UI:N), and leaves confidentiality untouched (C:N), with the full impact landing on integrity and availability (I:H/A:H); the practical exposure is narrowed because valid credentials are mandatory, the target is a specialized NVIDIA datacenter infrastructure component, and SSVC rates the issue non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis, EPSS places exploitation likelihood at roughly 0.5% (43rd percentile), and there is no CISA KEV listing - this is a genuine medium-to-high priority fix, not an emergency.
XML External Entity (XXE) injection in IBM webMethods Integration Server 11.1 allows an attacker with low-privileged access to submit malicious XML payloads that coerce the server's XML parser into disclosing sensitive filesystem contents or exhausting memory resources through recursive entity expansion. The vulnerability is confirmed by IBM with a patch available via advisory node/7286620. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType validation due to a multiline-flag inheritance bug in the PubidLiteral and SystemLiteral regex matchers: a publicId or systemId whose first line is a valid literal passes the check while ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) and breakout markup on subsequent lines are emitted verbatim into the <!DOCTYPE ...> declaration. This is a bypass of the mitigation introduced for the earlier DocumentType injection advisory; applications that treat requireWellFormed: true as a serialization-time security boundary against DOCTYPE injection are directly exposed. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.9.12.
XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) to bypass the requireWellFormed: true serialization guard and emit arbitrary markup verbatim into serialized XML output. The bypass exploits the multiline flag inherited by the QName_exact regex in lib/grammar.js, which causes the anchors to match at line boundaries rather than string boundaries - directly circumventing the strict-name validation introduced to close earlier injection advisories. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.