Monthly
XML External Entity injection in Sparx Systems Enterprise Architect's XSLT Debugger lets an attacker who convinces a user to open a crafted XML/XSLT file cause the parser to resolve an external DTD and disclose arbitrary files readable by the victim's Enterprise Architect process. The issue was reported by CERT-PL and has been confirmed only in version 17.1, with all other releases unverified because vendor contact attempts were unsuccessful; the CPE entry covers the product across all versions. It is unauthenticated in the network sense but requires the victim to actively load attacker-controlled content into the debugger (UI:A in the CVSS v4.0 vector, UI:R in our CVSS v3.1 assessment), confidentiality-only impact with no write or code execution demonstrated from this flaw alone, and no public exploit identified at time of analysis.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Arbitrary file system read in Adobe ColdFusion (2023 releases up to and including 2023.0.25 and 2025 releases up to and including 2025.0.13) is achievable through an XML External Entity (XXE) flaw that lets a remote attacker cause the server to resolve attacker-controlled external entities during XML processing. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C (8.6), meaning the attack is unauthenticated, requires no user interaction, and crosses a security boundary so that disclosed data lies outside the vulnerable component's own scope; impact is confidentiality-only (high) with no integrity or availability effect. No public exploit code and no CISA KEV entry were identified at time of analysis, so risk derives from how many unpatched, network-reachable XML-processing endpoints exist rather than from confirmed active exploitation.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains an XML external entity (XXE) injection flaw that allows an authenticated attacker holding an elevated/privileged account to read sensitive information from the application server and, through the changed-scope condition in the CVSS vector, potentially from resources beyond the vulnerable component's own security boundary. Network access with low attack complexity and no user interaction is required, but the PR:H privilege requirement confines realistic exploitation to insiders or attackers who have already obtained privileged credentials, making this a moderate-priority issue rather than an emergency; no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV.
XML external entity (XXE) processing is enabled by default across multiple request paths in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0, allowing an attacker who submits crafted XML to trigger server-side requests or read local files. The vulnerability is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning exploitation requires at least low-privileged credentials or an existing authenticated session - it is not an unauthenticated flaw - and the impact is limited to confidentiality loss and minor availability effects, with no integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently a matter of unpatched, authenticated attack surface rather than active exploitation. Progress has published a security advisory and fixed releases that disable default external entity processing.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Out-of-band XML External Entity (XXE) injection in Eclipse JAXB RI (jaxb-ri) lets an unauthenticated remote attacker read local files when an application unmarshals attacker-influenced XML through the affected JAXB factory helpers (XmlFactory in the core and xsom modules). The pre-patch code relied solely on XMLConstants.FEATURE_SECURE_PROCESSING, so on JAXP/SAX/DocumentBuilder implementations where that single feature does not disable DOCTYPE declarations, external general entities, external parameter entities, or external DTD loading, external entity resolution remains possible and file content can be exfiltrated out-of-band. Exploitation requires both conditions to hold - untrusted XML reaching JAXB unmarshalling, plus a parser stack where secure processing alone is insufficient - which is why the vector carries AC:H and the score is 8.3 (High) on both the supplied CVSS 4.0 vector and the independently assessed CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L). No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.
XML External Entity injection in Sparx Systems Enterprise Architect's XSLT Debugger lets an attacker who convinces a user to open a crafted XML/XSLT file cause the parser to resolve an external DTD and disclose arbitrary files readable by the victim's Enterprise Architect process. The issue was reported by CERT-PL and has been confirmed only in version 17.1, with all other releases unverified because vendor contact attempts were unsuccessful; the CPE entry covers the product across all versions. It is unauthenticated in the network sense but requires the victim to actively load attacker-controlled content into the debugger (UI:A in the CVSS v4.0 vector, UI:R in our CVSS v3.1 assessment), confidentiality-only impact with no write or code execution demonstrated from this flaw alone, and no public exploit identified at time of analysis.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Arbitrary file system read in Adobe ColdFusion (2023 releases up to and including 2023.0.25 and 2025 releases up to and including 2025.0.13) is achievable through an XML External Entity (XXE) flaw that lets a remote attacker cause the server to resolve attacker-controlled external entities during XML processing. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C (8.6), meaning the attack is unauthenticated, requires no user interaction, and crosses a security boundary so that disclosed data lies outside the vulnerable component's own scope; impact is confidentiality-only (high) with no integrity or availability effect. No public exploit code and no CISA KEV entry were identified at time of analysis, so risk derives from how many unpatched, network-reachable XML-processing endpoints exist rather than from confirmed active exploitation.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
Unauthenticated remote attackers can exploit XML external entity (XXE) handling in Commvault's CVFS component to read files from the underlying host, resulting in high-confidentiality information disclosure (CVSS 4.0 8.7 HIGH; vendor vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N). Affected deployments are Commvault Cloud and Grid (HSX) CVFS instances, per the vendor's CPE data, that remain on a pre-fix maintenance release and expose an XML-accepting CVFS interface to the network. Integrity and availability are unaffected, and no public exploit has been identified at time of analysis; the primary practical barrier is whether the storage/backup management plane is network-reachable rather than confined to an internal segment.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 contains an XML external entity (XXE) injection flaw that allows an authenticated attacker holding an elevated/privileged account to read sensitive information from the application server and, through the changed-scope condition in the CVSS vector, potentially from resources beyond the vulnerable component's own security boundary. Network access with low attack complexity and no user interaction is required, but the PR:H privilege requirement confines realistic exploitation to insiders or attackers who have already obtained privileged credentials, making this a moderate-priority issue rather than an emergency; no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV.
XML external entity (XXE) processing is enabled by default across multiple request paths in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0, allowing an attacker who submits crafted XML to trigger server-side requests or read local files. The vulnerability is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning exploitation requires at least low-privileged credentials or an existing authenticated session - it is not an unauthenticated flaw - and the impact is limited to confidentiality loss and minor availability effects, with no integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently a matter of unpatched, authenticated attack surface rather than active exploitation. Progress has published a security advisory and fixed releases that disable default external entity processing.
XML external entity (XXE) processing in Progress MarkLogic Server 11.x before 11.3.7 allows remote, unauthenticated attackers to disclose local files or trigger outbound network requests from the server through attacker-supplied SAML messages. Exploitation is conditional: the instance must be configured to use SAML single sign-on, since only the SAML parser's handling of external DTDs and entities is affected, and the impact is limited to confidentiality (C:H, no integrity or availability impact, CVSS 7.5). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this represents a genuine but conditional priority - patching matters most for deployments that have SAML SSO enabled and exposed to untrusted networks.
Out-of-band XML External Entity (XXE) injection in Eclipse JAXB RI (jaxb-ri) lets an unauthenticated remote attacker read local files when an application unmarshals attacker-influenced XML through the affected JAXB factory helpers (XmlFactory in the core and xsom modules). The pre-patch code relied solely on XMLConstants.FEATURE_SECURE_PROCESSING, so on JAXP/SAX/DocumentBuilder implementations where that single feature does not disable DOCTYPE declarations, external general entities, external parameter entities, or external DTD loading, external entity resolution remains possible and file content can be exfiltrated out-of-band. Exploitation requires both conditions to hold - untrusted XML reaching JAXB unmarshalling, plus a parser stack where secure processing alone is insufficient - which is why the vector carries AC:H and the score is 8.3 (High) on both the supplied CVSS 4.0 vector and the independently assessed CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L). No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis.
XML external entity injection in IBM DataPower Gateway 10.5.0.0-10.5.0.22, 10.6.0.0-10.6.0.10, 10.6.1-10.6.6, and 11.0.0.0-11.0.0.2 lets remote, unauthenticated attackers who can reach an XML-accepting endpoint read files or internal resources from the gateway host and, via entity expansion, exhaust memory. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L, base 8.2) confirms no credentials or user interaction are required, with high confidentiality impact and low availability impact. There is no public exploit code and no indication of active exploitation, and IBM has published a patch through its support portal.