Nanoxml
Monthly
XML External Entity (XXE) injection in NanoXML 2.2.3 allows low-privileged network attackers to trigger unauthorized interaction with external systems or read internal resources, because the library enables external entity processing by default with no opt-out enforced at the API level. The affected product is identified under CPE cpe:2.3:a:cyberelf:nanoxml:*:*:*:*:*:*:*:* and was reported by TCS-CERT with an ENISA EUVD entry (EUVD-2026-72683). No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects a moderate, subsequent-system confidentiality impact rather than direct system compromise.
XML External Entity (XXE) injection in NanoXML 2.2.3 allows low-privileged network attackers to trigger unauthorized interaction with external systems or read internal resources, because the library enables external entity processing by default with no opt-out enforced at the API level. The affected product is identified under CPE cpe:2.3:a:cyberelf:nanoxml:*:*:*:*:*:*:*:* and was reported by TCS-CERT with an ENISA EUVD entry (EUVD-2026-72683). No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.3 reflects a moderate, subsequent-system confidentiality impact rather than direct system compromise.