CWE-91

XML Injection (aka Blind XPath Injection)

13 CVEs Avg CVSS 7.0 MITRE
0
CRITICAL
8
HIGH
5
MEDIUM
0
LOW
3
POC
0
KEV

Monthly

CVE-2026-34601 HIGH PATCH NEWS GHSA This Week

XML injection in xmldom's CDATA serialization allows remote attackers to inject arbitrary markup into generated XML documents without authentication. The vulnerability affects both the legacy xmldom package and @xmldom/xmldom when applications embed untrusted input into CDATA sections. Attackers can break out of CDATA context by including the sequence ]]> in user-controlled strings, causing downstream XML consumers to parse injected elements as legitimate markup. Vendor-released patches are available in versions 0.8.12 and 0.9.9. EPSS data not provided; no confirmed active exploitation (CISA KEV status: not listed). Public proof-of-concept code exists in the GitHub security advisory.

Code Injection Mozilla
NVD GitHub VulDB
CVSS 3.1
7.5
EPSS
0.0%
CVE-2026-28770 HIGH POC This Week

XML injection in the IDC SFX2100 satellite receiver web interface allows authenticated attackers to inject arbitrary XML elements and execute reflected cross-site scripting attacks through unsanitized input in the checkifdone.cgi script. Public exploit code exists for this vulnerability, and potential for more severe attacks such as XXE exploitation has not been ruled out. No patch is currently available for affected firmware versions.

XSS XXE Sfx2100 Firmware
NVD
CVSS 3.1
8.8
EPSS
0.1%
CVE-2026-1554 MEDIUM PATCH This Month

Central Authentication System Server versions up to 2.0.3 contains a security vulnerability (CVSS 4.2).

Drupal Privilege Escalation Central Authentication System Server
NVD
CVSS 3.1
4.2
EPSS
0.0%
CVE-2022-50902 HIGH POC This Week

FSService contains a vulnerability that allows attackers to potentially execute code with elevated privileges (CVSS 8.4).

Code Injection
NVD Exploit-DB
CVSS 3.1
8.4
EPSS
0.0%
CVE-2025-1545 HIGH This Week

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.This issue affects Fireware OS 11.11 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

Information Disclosure Fireware
NVD
CVSS 3.1
7.5
EPSS
0.1%
CVE-2025-66034 MEDIUM POC PATCH This Month

fontTools is a library for manipulating fonts, written in Python. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required. Public exploit code available.

RCE Python Fonttools Redhat Suse
NVD GitHub
CVSS 3.1
6.3
EPSS
0.1%
CVE-2025-54251 MEDIUM Monitor

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Authentication Bypass Adobe Experience Manager
NVD
CVSS 3.1
4.3
EPSS
8.4%
CVE-2025-24404 HIGH This Month

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Apache Hertzbeat
NVD
CVSS 3.1
8.8
EPSS
0.1%
CVE-2025-9375 MEDIUM PATCH This Month

XML Injection vulnerability in xmltodict allows Input Data Manipulation.14.2 before 0.15.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Redhat Suse
NVD GitHub
CVSS 4.0
6.9
EPSS
0.1%
CVE-2025-47184 MEDIUM This Month

An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

XXE Privilege Escalation Information Disclosure
NVD GitHub
CVSS 3.1
5.3
EPSS
0.0%
CVE-2026-34601
EPSS 0% CVSS 7.5
HIGH PATCH This Week

XML injection in xmldom's CDATA serialization allows remote attackers to inject arbitrary markup into generated XML documents without authentication. The vulnerability affects both the legacy xmldom package and @xmldom/xmldom when applications embed untrusted input into CDATA sections. Attackers can break out of CDATA context by including the sequence ]]> in user-controlled strings, causing downstream XML consumers to parse injected elements as legitimate markup. Vendor-released patches are available in versions 0.8.12 and 0.9.9. EPSS data not provided; no confirmed active exploitation (CISA KEV status: not listed). Public proof-of-concept code exists in the GitHub security advisory.

Code Injection Mozilla
NVD GitHub VulDB
CVE-2026-28770
EPSS 0% CVSS 8.8
HIGH POC This Week

XML injection in the IDC SFX2100 satellite receiver web interface allows authenticated attackers to inject arbitrary XML elements and execute reflected cross-site scripting attacks through unsanitized input in the checkifdone.cgi script. Public exploit code exists for this vulnerability, and potential for more severe attacks such as XXE exploitation has not been ruled out. No patch is currently available for affected firmware versions.

XSS XXE Sfx2100 Firmware
NVD
CVE-2026-1554
EPSS 0% CVSS 4.2
MEDIUM PATCH This Month

Central Authentication System Server versions up to 2.0.3 contains a security vulnerability (CVSS 4.2).

Drupal Privilege Escalation Central Authentication System Server
NVD
CVE-2022-50902
EPSS 0% CVSS 8.4
HIGH POC This Week

FSService contains a vulnerability that allows attackers to potentially execute code with elevated privileges (CVSS 8.4).

Code Injection
NVD Exploit-DB
CVE-2025-1545
EPSS 0% CVSS 7.5
HIGH This Week

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.This issue affects Fireware OS 11.11 up to and including 11.12.4+541730, 12.0 up to and including 12.11.4, 12.5 up to and including 12.5.13, and 2025.1 up to and including 2025.1.2.

Information Disclosure Fireware
NVD
CVE-2025-66034
EPSS 0% CVSS 6.3
MEDIUM POC PATCH This Month

fontTools is a library for manipulating fonts, written in Python. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required. Public exploit code available.

RCE Python Fonttools +2
NVD GitHub
CVE-2025-54251
EPSS 8% CVSS 4.3
MEDIUM Monitor

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Authentication Bypass Adobe Experience Manager
NVD
CVE-2025-24404
EPSS 0% CVSS 8.8
HIGH This Month

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Code Injection Apache Hertzbeat
NVD
CVE-2025-9375
EPSS 0% CVSS 6.9
MEDIUM PATCH This Month

XML Injection vulnerability in xmltodict allows Input Data Manipulation.14.2 before 0.15.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Redhat Suse
NVD GitHub
CVE-2025-47184
EPSS 0% CVSS 5.3
MEDIUM This Month

An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

XXE Privilege Escalation Information Disclosure
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy