XXE
Monthly
Markus versions up to 2.9.4 is affected by improper restriction of recursive entity references in dtds (CVSS 4.9).
XML injection in the IDC SFX2100 satellite receiver web interface allows authenticated attackers to inject arbitrary XML elements and execute reflected cross-site scripting attacks through unsanitized input in the checkifdone.cgi script. Public exploit code exists for this vulnerability, and potential for more severe attacks such as XXE exploitation has not been ruled out. No patch is currently available for affected firmware versions.
Infosphere Information Server versions up to 11.7.1.6 is affected by improper restriction of xml external entity reference (CVSS 7.1).
Jeesite versions up to 5.15.1. contains a vulnerability that allows attackers to xml external entity reference (CVSS 5.0).
Xerox FreeFlow Core versions through 8.0.7 contain an XML External Entity (XXE) vulnerability that allows unauthenticated remote attackers to conduct Server-Side Request Forgery attacks by submitting malicious XML input. This vulnerability could enable attackers to access internal resources or sensitive data on the affected system. A patch is currently unavailable, though Xerox recommends upgrading to version 8.1.0.
Db2 versions up to 12.1.3 is affected by improper restriction of xml external entity reference (CVSS 7.1).
OpenCC JFlow versions up to 20260129 contain an XML External Entity (XXE) injection vulnerability in the Workflow Engine's file handling component that allows authenticated remote attackers to read sensitive files or perform denial of service attacks. Public exploit code exists for this vulnerability, and the vendor has not yet provided a patch. The issue affects Java-based deployments and requires valid credentials to exploit.
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. [CVSS 6.2 MEDIUM]
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from Workstation.
O2OA versions up to 9.0.0 contain an XML external entity (XXE) injection vulnerability in the /x_program_center/jaxrs/mpweixin/check HTTP POST handler that allows authenticated remote attackers to read sensitive files or conduct denial-of-service attacks. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. The attack requires valid credentials but can be executed over the network without user interaction.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can ...
Syncope versions up to 3.0.15 is affected by improper restriction of xml external entity reference (CVSS 4.9).
IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. [CVSS 7.1 HIGH]
XXE injection in Atlassian Crowd Data Center and Server 7.1.0+ enables authenticated attackers to read local and remote files, significantly compromising confidentiality and availability. The vulnerability requires high privileges to exploit but accepts no user interaction, affecting multiple Crowd versions until patching to 7.1.3 or later. No patch is currently available for all affected versions.
XXE (XML External Entity) injection in AssertJ Java testing library from 1.4.0 to before 3.27.7 allows reading arbitrary files when parsing XML assertions. Patch available.
XDocReport v0.9.2 through v2.0.3 has an XML External Entity (XXE) vulnerability that allows attackers to read arbitrary files, perform SSRF, and potentially achieve remote code execution.
XXE injection in Bjskzy Zhiyou ERP through the RichClientService component allows authenticated attackers to read sensitive files and manipulate XML data from the network. Public exploit code exists for this vulnerability affecting versions up to 11.0, and the vendor has not provided a patch despite early disclosure notification.
Demo Importer Plus (WordPress plugin) is affected by improper restriction of xml external entity reference (CVSS 7.5).
Geonetwork versions up to 4.2.0 is affected by improper restriction of xml external entity reference (CVSS 6.5).
Struts versions up to 2.2.1 is affected by improper restriction of xml external entity reference (CVSS 8.1).
Bio-Formats versions up to 8.3.0 contain an XML External Entity (XXE) injection vulnerability in the Leica Microsystems metadata parser that fails to disable external entity expansion. A local attacker can exploit this by crafting malicious XML metadata files to trigger server-side request forgery, read local files, or cause denial of service. No patch is currently available.
Unisphere For Powermax versions up to 9.2.4.18 is affected by improper restriction of xml external entity reference (CVSS 7.6).
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services: * Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG). * Parsing of ISO 19115 metadata in XML for...
Biopython's Bio.Entrez module through version 1.86 is vulnerable to XML external entity (XXE) injection in doctype parsing, allowing authenticated remote attackers to read arbitrary files or cause denial of service. The vulnerability requires authenticated access and high attack complexity, resulting in a CVSS score of 4.9 with low confidentiality and availability impact across trust boundaries. Exploitation is not currently tracked in CISA KEV and has extremely low EPSS probability (0.07%, 20th percentile), indicating limited real-world risk despite the XXE vector.
Arbitrary file read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier stems from an XML External Entity (XXE) flaw (CWE-611) that lets remote unauthenticated attackers retrieve sensitive files from the server. Adobe rates the issue 8.6 (CVSS 3.1) with a scope change, and no public exploit is identified at time of analysis, though the description notes exploitation depends on conditions beyond the attacker's control.
XML External Entity (XXE) injection in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows remote attackers to read arbitrary files from the server filesystem via maliciously crafted XML documents requiring user interaction. The vulnerability achieves scope change (CVSS S:C), meaning exploitation can affect resources beyond the vulnerable component. Adobe has released patches in APSB25-105. No confirmed active exploitation (CISA KEV) or public POC identified at time of analysis. EPSS data not available.
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.
Mustang before 2.16.3 allows exfiltrating files via XXE attacks. Rated low severity (CVSS 2.8). No vendor patch available.
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Kivitendo before 3.9.2 allows XXE injection. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GeoServer contains an XXE vulnerability in the WMS GetMap operation allowing unauthenticated attackers to read server files and perform SSRF attacks.
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in bestfeng oa_git_free up to 9.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
We need to produce a JSON object with specific fields. Let's analyze the input carefully. Input: - CVE ID: CVE-2025-11341 - Description: "A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited." - CVSS Score: 5.5 (looks like a score, but vector is CVSS v4.0. I'll use that.) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-610 Externally Controlled Reference to a Resource in Another Sphere (probably XML External Entity) - EPSS Score: 0.03% (percentile 10%) - POC/Exploit: Publicly available - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* (version up to 2.0) - Tags: XXE, Jinher Oa - References: three VulDB links, one GitHub issue. Potential for KEV? No mention of KEV in input, so not in KEV. So exploitation status: "publicly available exploit code exists" because POC/Exploit says publicly available, but no KEV confirmation. So "publicly available exploit code exists". We'll note that. Now fields: product_name: "Jinher OA" (up to 2.0). Product name is "Jinher OA". So "Jinher OA" (1-3 words). I'll just use "Jinher OA". summary: 2-3 sentence plain-language synthesis. Do not copy description. Start with impact verb and product. E.g. "XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to read local files or perform server-side request forgery via crafted XML input to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx". The description says "xml external entity reference", remote exploitation possible. Exploit publicly released. EPSS low. No KEV. So summary: "An XML External Entity (XXE) injection vulnerability in Jinher OA (up to version 2.0) allows unauthenticated attackers to exfiltrate local files or perform SSRF by sending crafted requests to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx. Exploit code is publicly available, but EPSS suggests low exploitation probability." Actually EPSS 0.03% is very low, but exploit publicly available. So mention POC available. Start with "XML External Entity (XXE) injection in Jinher OA allows unauthenticated remote attackers to...". Yes. technical_context: Mention the underlying technology: Jinher OA is an office automation platform likely using ASP.NET (from the .aspx path). The vulnerability is CWE-610, XXE. The attack vector is remote, via HTTP request to a specific page. The CPE is cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*, indicating all versions up to 2.0. The vulnerability arises from parsing untrusted XML with external entity processing enabled. The file path suggests a WebDesign.aspx page that processes XML. Use educational tone. risk_assessment: Use provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N with impacts VC:L/VI:L/VA:L (confidentiality, integrity, availability all low). EPSS 0.03%, very low exploitation probability. No KEV. POC publicly available. CVSS score 5.5 (medium). So risk: low threat activity but easy attack, so moderate risk if exposed. Check conflicting signals: CVSS indicates network vector, unauthenticated, low impact. EPSS suggests rare active exploitation. So while exploit is available, it's not widely targeted. So risk is limited to specific exposed instances. No conflicting. affected_products: Write paragraph: "Jinher OA versions up to 2.0, as identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The specific vulnerable endpoint is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx?type=SystemUserInfo&style=1. Vendor advisory may be available from VulDB (links provided)." But we need to avoid bullet points, just narrative. So: "Jinher OA versions up to and including 2.0 are affected. The known vulnerable file is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx with specific parameters. The vendor advisory is tracked by VulDB (https://vuldb.com/?id.327226)." remediation: No patch version given. No mention of fixed version. So we need to suggest compensating controls. Since no patch, recommend: "Upgrade to a version beyond 2.0 if available, or apply input validation to disable XML external entity processing. As an immediate mitigation, restrict network access to the vulnerable endpoint or implement a web application firewall (WAF) rule to block XXE payloads. Disabling DTD processing in the XML parser configuration, if possible, would prevent exploitation." No exact version, so say: "No vendor-released patch has been confirmed; mitigate by disabling XML external entity processing or restricting access to the vulnerable aspx page." We'll craft. exploit_scenario: Realistic attack: An attacker sends a specially crafted HTTP request to the vulnerable endpoint containing a malicious XML payload with an external entity that points to a local file (e.g., /etc/passwd) or an external server to exfiltrate data. Since no authentication is required (PR:N), remote unauthenticated exploitation is possible. POC available. exploitation_conditions: The CVSS vector shows AV:N, so network accessible. PR:N so no authentication needed? Vector says PR:N, so unauthenticated. UI:N, so no user interaction. No specific conditions in description beyond the endpoint URL. It says "Performing manipulation results in xml external entity reference." No mention of special configuration. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Jinher OA up to 2.0, provided the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint is accessible over the network." The file path is specific, so it must be accessible. No limiting factors like authentication, so it's wide open. So: "No authentication or user interaction is required; the vulnerable endpoint must be reachable over the network. The attack works with default configurations." That's enough. attack_chain: Follow kill chain: Remote attacker discovers vulnerable endpoint → Sends crafted XML request with external entity → XML parser processes entity, allowing file read or SSRF → Impact (Confidentiality/Integrity/Availability low). We'll use: "Send crafted HTTP POST request to vulnerable endpoint → XML parser resolves external entity → Exfiltrate sensitive file contents or perform SSRF". Steps: Access → Delivery (HTTP request with XML) → Exploit (XXE) → Execution (entity resolution) → Impact (file read/SSRF). I'll construct a chain of 4 steps: "Send crafted XML payload to WebDesign.aspx → Trigger XML external entity processing → Access arbitrary local files via entity resolution → Use exfiltrated data or trigger SSRF for further access". That's 4. Good. confidence_notes: We know exploit code is publicly available (GitHub issue referenced). The CVSS vector provided is from VulDB likely, but NVD hasn't published yet? The CVE is from VulDB. NVD references include the GitHub link as exploit. No vendor confirmation, just VulDB report. So: "Exploit code confirmed publicly available via GitHub. Affected product and version range confirmed by CPE from VulDB. No official vendor advisory or patch identified; patch status unknown. CVSS vector from VulDB indicates network-accessible, unauthenticated attack with low impact." We'll state what's missing. prevalence: Jinher OA is an office automation platform, likely Chinese product. How widely deployed? I'm not sure. It might be niche. I'll estimate low or medium? I'm leaning low because it's not a globally known product. Possibly used in some Chinese enterprises. I'll go with "low" and basis: "niche Chinese OA platform, limited enterprise deployment". Might be unknown but I'll pick low. prevalence_basis: "niche Chinese OA platform, limited global footprint." That's within 12 words. assessed_cvss_vector: We're supposed to provide our own CVSS 3.1 vector, not copy the given 4.0 one. Given the description: remote, unauthenticated, XXE. Attack vector: Network (AV:N). Attack Complexity: Low (AC:L) because just sending crafted request. Privileges Required: None (PR:N) because no authentication mentioned. User Interaction: None (UI:N) because no user involved. Scope: Unchanged? XXE can sometimes lead to scope change if exfiltrating data from a different system, but typically file read is on the same system, so Scope U. Confidentiality Impact: Low (C:L) as described in VC:L. Integrity Impact: Low (I:L). Availability Impact: Low (A:L). So vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's consistent. I'll output that as my assessed CVSS 3.1 vector. assessed_cvss_rationale: "Remote network exploitation without authentication or user interaction, with low confidentiality, integrity, and availability impacts from file read and SSRF." assessed_cvss40_vector: They already gave one, but I'll produce my own assessment consistent with the 3.1 vector. For 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. I'll use that. Now assemble JSON. Ensure all fields are strings. No arrays, no nesting. Use double quotes. Make sure the summary does not say "A vulnerability..." but start with "XML External Entity (XXE) injection in Jinher OA...". Yes. technical_context: mention CWE-610 and that it's an XML parsing issue with external entity processing. Use CPE to point to affected product. "The vulnerability is an XML External Entity injection (CWE-610) in the Jinher OA web application, which likely uses an ASP.NET XML parser that defaults to enabling external entity resolution. The vulnerable endpoint processes user-supplied XML in a POST request, and by crafting a malicious XML document with an external entity pointing to a local file or internal resource, an attacker can read sensitive files or initiate SSRF. The CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* captures all versions up to 2.0." risk_assessment: "CVSS 4.0 scores this as 5.5 Medium, with network attack vector, low complexity, no privileges or user interaction required, and low impact on all three CIA metrics. The EPSS estimate of 0.03% suggests very low likelihood of active exploitation in the wild, despite the public availability of exploit code. No CISA KEV entry indicates no known active exploitation campaigns. Overall, this is a straightforward XXE vulnerability but with limited post-exploitation impact, making it a moderate priority for organizations using the affected product." affected_products: "Jinher OA versions up to and including 2.0, identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The vulnerability is located in the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint with specific parameters. The report is available at VulDB (https://vuldb.com/?id.327226)." remediation: "Apply the vendor patch if available (no specific version identified in the advisory). As a workaround, disable XML external entity processing in the application's XML parser configuration, or restrict network access to the vulnerable .aspx file using a WAF or firewall rules. Disabling DTD resolution entirely may break legitimate functionality if required by the application; test thoroughly before deploying." exploit_scenario: "An unauthenticated remote attacker sends a specially crafted HTTP POST request to the vulnerable /c6/Jhsoft.Web
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Jinher OA 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Jinher OA 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
OpenKilda is an open-source OpenFlow controller. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XML External Entity (XXE) processing vulnerability in Jinher OA 1.1 allows unauthenticated remote attackers to read local files or perform server-side request forgery via the XmlHttp.aspx endpoint. Public exploit code is available, though no active exploitation has been reported and EPSS indicates low exploitation probability.
XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and potentially exfiltrate data via the ProjectScheduleDelete.aspx endpoint. Exploit code is publicly available, but the EPSS exploitation probability remains low (0.07%) and the vulnerability is not known to be actively exploited.
XML External Entity (XXE) injection in agorum core open's RSSReader endpoint enables remote attackers to exfiltrate sensitive server-side data by submitting crafted XML payloads. Affected versions are v11.9.2 and v11.10.1 of this document management platform. EPSS exploitation probability sits at 0.22% (13th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA's KEV catalog - indicating low observed exploitation pressure despite the network-accessible, unauthenticated attack surface described by the CVSS vector.
Apache Jackrabbit versions prior to 2.23.2 contain blind XXE (XML External Entity) vulnerabilities in jackrabbit-spi-commons and jackrabbit-core components due to unsafe XML document parsing when loading privilege definitions. An authenticated attacker with low privileges can exploit this to achieve high-impact confidentiality, integrity, and availability compromise. The vulnerability requires user authentication (PR:L) but has no interaction requirement and affects all systems regardless of scope.
CVE-2025-7523 is an XML External Entity (XXE) injection vulnerability in Jinher OA 1.0 affecting the /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx endpoint. An unauthenticated remote attacker can exploit this to read sensitive files, modify data, or cause denial of service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6438 is a security vulnerability (CVSS 5.9). Remediation should follow standard vulnerability management procedures.
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service by bypassing security measures. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
CVE-2025-49493 is a security vulnerability (CVSS 5.8) that allows file inclusion. Remediation should follow standard vulnerability management procedures.
Allure 2 versions prior to 2.34.1 contain a critical XML External Entity (XXE) injection vulnerability in the xunit-xml-plugin that allows unauthenticated remote attackers to read arbitrary files from the server's filesystem and potentially trigger SSRF attacks. The vulnerability stems from insecure XML parser configuration in the DocumentBuilderFactory and is exploitable by uploading or providing malicious test result XML files without any authentication or user interaction required.
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 contain an XML External Entity (XXE) injection vulnerability that allows authenticated remote attackers to extract sensitive information or trigger denial-of-service conditions through memory exhaustion. The vulnerability requires valid credentials (CVSS PR:L) but has a high confidentiality impact (C:H) and affects a critical security infrastructure product. No publicly available evidence of active exploitation or public POCs has been confirmed at this time.
CVE-2025-36049 is a security vulnerability (CVSS 8.8). High severity vulnerability requiring prompt remediation.
Keyoti SearchUnit versions prior to 9.0.0 contain an XML External Entity (XXE) injection vulnerability that allows unauthenticated remote attackers to exfiltrate sensitive files from affected systems. The vulnerability has a CVSS 3.1 score of 7.5 (High) with a network attack vector, no privileges required, and no user interaction needed. While no public POC or active in-the-wild exploitation has been widely documented, the straightforward attack vector and high confidentiality impact make this a significant risk for organizations running vulnerable SearchUnit instances.
A remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Vendor patch is available.
CVE-2025-31039 is an XML External Entity (XXE) injection vulnerability in the Pixelgrade Category Icon WordPress plugin (versions through 1.0.2) that allows authenticated attackers with high privileges to read arbitrary files, execute remote code, or cause denial of service through improper XML entity validation. The vulnerability has a critical CVSS score of 9.1 but requires administrator-level privileges to exploit; active exploitation status and proof-of-concept availability are not confirmed from the provided intelligence.
CVE-2025-5877 is a security vulnerability (CVSS 6.3). Risk factors: public PoC available.
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sulu is an open-source PHP content management system based on the Symfony framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 24.6%.
SysAid On-Prem contains a second unauthenticated XXE injection in Server URL processing, providing an alternative attack path to the Checkin XXE (CVE-2025-2775) for admin takeover.
Markus versions up to 2.9.4 is affected by improper restriction of recursive entity references in dtds (CVSS 4.9).
XML injection in the IDC SFX2100 satellite receiver web interface allows authenticated attackers to inject arbitrary XML elements and execute reflected cross-site scripting attacks through unsanitized input in the checkifdone.cgi script. Public exploit code exists for this vulnerability, and potential for more severe attacks such as XXE exploitation has not been ruled out. No patch is currently available for affected firmware versions.
Infosphere Information Server versions up to 11.7.1.6 is affected by improper restriction of xml external entity reference (CVSS 7.1).
Jeesite versions up to 5.15.1. contains a vulnerability that allows attackers to xml external entity reference (CVSS 5.0).
Xerox FreeFlow Core versions through 8.0.7 contain an XML External Entity (XXE) vulnerability that allows unauthenticated remote attackers to conduct Server-Side Request Forgery attacks by submitting malicious XML input. This vulnerability could enable attackers to access internal resources or sensitive data on the affected system. A patch is currently unavailable, though Xerox recommends upgrading to version 8.1.0.
Db2 versions up to 12.1.3 is affected by improper restriction of xml external entity reference (CVSS 7.1).
OpenCC JFlow versions up to 20260129 contain an XML External Entity (XXE) injection vulnerability in the Workflow Engine's file handling component that allows authenticated remote attackers to read sensitive files or perform denial of service attacks. Public exploit code exists for this vulnerability, and the vendor has not yet provided a patch. The issue affects Java-based deployments and requires valid credentials to exploit.
MSN Password Recovery 1.30 contains an XML external entity injection vulnerability that allows attackers to read local system files through crafted XML input. [CVSS 6.2 MEDIUM]
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from Workstation.
O2OA versions up to 9.0.0 contain an XML external entity (XXE) injection vulnerability in the /x_program_center/jaxrs/mpweixin/check HTTP POST handler that allows authenticated remote attackers to read sensitive files or conduct denial-of-service attacks. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. The attack requires valid credentials but can be executed over the network without user interaction.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can ...
Syncope versions up to 3.0.15 is affected by improper restriction of xml external entity reference (CVSS 4.9).
IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflow traditional V25.0.0, V24.0.1, V24.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. [CVSS 7.1 HIGH]
XXE injection in Atlassian Crowd Data Center and Server 7.1.0+ enables authenticated attackers to read local and remote files, significantly compromising confidentiality and availability. The vulnerability requires high privileges to exploit but accepts no user interaction, affecting multiple Crowd versions until patching to 7.1.3 or later. No patch is currently available for all affected versions.
XXE (XML External Entity) injection in AssertJ Java testing library from 1.4.0 to before 3.27.7 allows reading arbitrary files when parsing XML assertions. Patch available.
XDocReport v0.9.2 through v2.0.3 has an XML External Entity (XXE) vulnerability that allows attackers to read arbitrary files, perform SSRF, and potentially achieve remote code execution.
XXE injection in Bjskzy Zhiyou ERP through the RichClientService component allows authenticated attackers to read sensitive files and manipulate XML data from the network. Public exploit code exists for this vulnerability affecting versions up to 11.0, and the vendor has not provided a patch despite early disclosure notification.
Demo Importer Plus (WordPress plugin) is affected by improper restriction of xml external entity reference (CVSS 7.5).
Geonetwork versions up to 4.2.0 is affected by improper restriction of xml external entity reference (CVSS 6.5).
Struts versions up to 2.2.1 is affected by improper restriction of xml external entity reference (CVSS 8.1).
Bio-Formats versions up to 8.3.0 contain an XML External Entity (XXE) injection vulnerability in the Leica Microsystems metadata parser that fails to disable external entity expansion. A local attacker can exploit this by crafting malicious XML metadata files to trigger server-side request forgery, read local files, or cause denial of service. No patch is currently available.
Unisphere For Powermax versions up to 9.2.4.18 is affected by improper restriction of xml external entity reference (CVSS 7.6).
Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services: * Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG). * Parsing of ISO 19115 metadata in XML for...
Biopython's Bio.Entrez module through version 1.86 is vulnerable to XML external entity (XXE) injection in doctype parsing, allowing authenticated remote attackers to read arbitrary files or cause denial of service. The vulnerability requires authenticated access and high attack complexity, resulting in a CVSS score of 4.9 with low confidentiality and availability impact across trust boundaries. Exploitation is not currently tracked in CISA KEV and has extremely low EPSS probability (0.07%, 20th percentile), indicating limited real-world risk despite the XXE vector.
Arbitrary file read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier stems from an XML External Entity (XXE) flaw (CWE-611) that lets remote unauthenticated attackers retrieve sensitive files from the server. Adobe rates the issue 8.6 (CVSS 3.1) with a scope change, and no public exploit is identified at time of analysis, though the description notes exploitation depends on conditions beyond the attacker's control.
XML External Entity (XXE) injection in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows remote attackers to read arbitrary files from the server filesystem via maliciously crafted XML documents requiring user interaction. The vulnerability achieves scope change (CVSS S:C), meaning exploitation can affect resources beyond the vulnerable component. Adobe has released patches in APSB25-105. No confirmed active exploitation (CISA KEV) or public POC identified at time of analysis. EPSS data not available.
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. First, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to >= 3.2.2 would still be vulnerable. Second, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the "org.apache.tika:tika-parsers" module.
XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request.
Mustang before 2.16.3 allows exfiltrating files via XXE attacks. Rated low severity (CVSS 2.8). No vendor patch available.
Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Kivitendo before 3.9.2 allows XXE injection. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GeoServer contains an XXE vulnerability in the WMS GetMap operation allowing unauthenticated attackers to read server files and perform SSRF attacks.
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in bestfeng oa_git_free up to 9.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
We need to produce a JSON object with specific fields. Let's analyze the input carefully. Input: - CVE ID: CVE-2025-11341 - Description: "A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited." - CVSS Score: 5.5 (looks like a score, but vector is CVSS v4.0. I'll use that.) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-610 Externally Controlled Reference to a Resource in Another Sphere (probably XML External Entity) - EPSS Score: 0.03% (percentile 10%) - POC/Exploit: Publicly available - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* (version up to 2.0) - Tags: XXE, Jinher Oa - References: three VulDB links, one GitHub issue. Potential for KEV? No mention of KEV in input, so not in KEV. So exploitation status: "publicly available exploit code exists" because POC/Exploit says publicly available, but no KEV confirmation. So "publicly available exploit code exists". We'll note that. Now fields: product_name: "Jinher OA" (up to 2.0). Product name is "Jinher OA". So "Jinher OA" (1-3 words). I'll just use "Jinher OA". summary: 2-3 sentence plain-language synthesis. Do not copy description. Start with impact verb and product. E.g. "XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to read local files or perform server-side request forgery via crafted XML input to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx". The description says "xml external entity reference", remote exploitation possible. Exploit publicly released. EPSS low. No KEV. So summary: "An XML External Entity (XXE) injection vulnerability in Jinher OA (up to version 2.0) allows unauthenticated attackers to exfiltrate local files or perform SSRF by sending crafted requests to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx. Exploit code is publicly available, but EPSS suggests low exploitation probability." Actually EPSS 0.03% is very low, but exploit publicly available. So mention POC available. Start with "XML External Entity (XXE) injection in Jinher OA allows unauthenticated remote attackers to...". Yes. technical_context: Mention the underlying technology: Jinher OA is an office automation platform likely using ASP.NET (from the .aspx path). The vulnerability is CWE-610, XXE. The attack vector is remote, via HTTP request to a specific page. The CPE is cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*, indicating all versions up to 2.0. The vulnerability arises from parsing untrusted XML with external entity processing enabled. The file path suggests a WebDesign.aspx page that processes XML. Use educational tone. risk_assessment: Use provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N with impacts VC:L/VI:L/VA:L (confidentiality, integrity, availability all low). EPSS 0.03%, very low exploitation probability. No KEV. POC publicly available. CVSS score 5.5 (medium). So risk: low threat activity but easy attack, so moderate risk if exposed. Check conflicting signals: CVSS indicates network vector, unauthenticated, low impact. EPSS suggests rare active exploitation. So while exploit is available, it's not widely targeted. So risk is limited to specific exposed instances. No conflicting. affected_products: Write paragraph: "Jinher OA versions up to 2.0, as identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The specific vulnerable endpoint is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx?type=SystemUserInfo&style=1. Vendor advisory may be available from VulDB (links provided)." But we need to avoid bullet points, just narrative. So: "Jinher OA versions up to and including 2.0 are affected. The known vulnerable file is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx with specific parameters. The vendor advisory is tracked by VulDB (https://vuldb.com/?id.327226)." remediation: No patch version given. No mention of fixed version. So we need to suggest compensating controls. Since no patch, recommend: "Upgrade to a version beyond 2.0 if available, or apply input validation to disable XML external entity processing. As an immediate mitigation, restrict network access to the vulnerable endpoint or implement a web application firewall (WAF) rule to block XXE payloads. Disabling DTD processing in the XML parser configuration, if possible, would prevent exploitation." No exact version, so say: "No vendor-released patch has been confirmed; mitigate by disabling XML external entity processing or restricting access to the vulnerable aspx page." We'll craft. exploit_scenario: Realistic attack: An attacker sends a specially crafted HTTP request to the vulnerable endpoint containing a malicious XML payload with an external entity that points to a local file (e.g., /etc/passwd) or an external server to exfiltrate data. Since no authentication is required (PR:N), remote unauthenticated exploitation is possible. POC available. exploitation_conditions: The CVSS vector shows AV:N, so network accessible. PR:N so no authentication needed? Vector says PR:N, so unauthenticated. UI:N, so no user interaction. No specific conditions in description beyond the endpoint URL. It says "Performing manipulation results in xml external entity reference." No mention of special configuration. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Jinher OA up to 2.0, provided the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint is accessible over the network." The file path is specific, so it must be accessible. No limiting factors like authentication, so it's wide open. So: "No authentication or user interaction is required; the vulnerable endpoint must be reachable over the network. The attack works with default configurations." That's enough. attack_chain: Follow kill chain: Remote attacker discovers vulnerable endpoint → Sends crafted XML request with external entity → XML parser processes entity, allowing file read or SSRF → Impact (Confidentiality/Integrity/Availability low). We'll use: "Send crafted HTTP POST request to vulnerable endpoint → XML parser resolves external entity → Exfiltrate sensitive file contents or perform SSRF". Steps: Access → Delivery (HTTP request with XML) → Exploit (XXE) → Execution (entity resolution) → Impact (file read/SSRF). I'll construct a chain of 4 steps: "Send crafted XML payload to WebDesign.aspx → Trigger XML external entity processing → Access arbitrary local files via entity resolution → Use exfiltrated data or trigger SSRF for further access". That's 4. Good. confidence_notes: We know exploit code is publicly available (GitHub issue referenced). The CVSS vector provided is from VulDB likely, but NVD hasn't published yet? The CVE is from VulDB. NVD references include the GitHub link as exploit. No vendor confirmation, just VulDB report. So: "Exploit code confirmed publicly available via GitHub. Affected product and version range confirmed by CPE from VulDB. No official vendor advisory or patch identified; patch status unknown. CVSS vector from VulDB indicates network-accessible, unauthenticated attack with low impact." We'll state what's missing. prevalence: Jinher OA is an office automation platform, likely Chinese product. How widely deployed? I'm not sure. It might be niche. I'll estimate low or medium? I'm leaning low because it's not a globally known product. Possibly used in some Chinese enterprises. I'll go with "low" and basis: "niche Chinese OA platform, limited enterprise deployment". Might be unknown but I'll pick low. prevalence_basis: "niche Chinese OA platform, limited global footprint." That's within 12 words. assessed_cvss_vector: We're supposed to provide our own CVSS 3.1 vector, not copy the given 4.0 one. Given the description: remote, unauthenticated, XXE. Attack vector: Network (AV:N). Attack Complexity: Low (AC:L) because just sending crafted request. Privileges Required: None (PR:N) because no authentication mentioned. User Interaction: None (UI:N) because no user involved. Scope: Unchanged? XXE can sometimes lead to scope change if exfiltrating data from a different system, but typically file read is on the same system, so Scope U. Confidentiality Impact: Low (C:L) as described in VC:L. Integrity Impact: Low (I:L). Availability Impact: Low (A:L). So vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's consistent. I'll output that as my assessed CVSS 3.1 vector. assessed_cvss_rationale: "Remote network exploitation without authentication or user interaction, with low confidentiality, integrity, and availability impacts from file read and SSRF." assessed_cvss40_vector: They already gave one, but I'll produce my own assessment consistent with the 3.1 vector. For 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. I'll use that. Now assemble JSON. Ensure all fields are strings. No arrays, no nesting. Use double quotes. Make sure the summary does not say "A vulnerability..." but start with "XML External Entity (XXE) injection in Jinher OA...". Yes. technical_context: mention CWE-610 and that it's an XML parsing issue with external entity processing. Use CPE to point to affected product. "The vulnerability is an XML External Entity injection (CWE-610) in the Jinher OA web application, which likely uses an ASP.NET XML parser that defaults to enabling external entity resolution. The vulnerable endpoint processes user-supplied XML in a POST request, and by crafting a malicious XML document with an external entity pointing to a local file or internal resource, an attacker can read sensitive files or initiate SSRF. The CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* captures all versions up to 2.0." risk_assessment: "CVSS 4.0 scores this as 5.5 Medium, with network attack vector, low complexity, no privileges or user interaction required, and low impact on all three CIA metrics. The EPSS estimate of 0.03% suggests very low likelihood of active exploitation in the wild, despite the public availability of exploit code. No CISA KEV entry indicates no known active exploitation campaigns. Overall, this is a straightforward XXE vulnerability but with limited post-exploitation impact, making it a moderate priority for organizations using the affected product." affected_products: "Jinher OA versions up to and including 2.0, identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The vulnerability is located in the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint with specific parameters. The report is available at VulDB (https://vuldb.com/?id.327226)." remediation: "Apply the vendor patch if available (no specific version identified in the advisory). As a workaround, disable XML external entity processing in the application's XML parser configuration, or restrict network access to the vulnerable .aspx file using a WAF or firewall rules. Disabling DTD resolution entirely may break legitimate functionality if required by the application; test thoroughly before deploying." exploit_scenario: "An unauthenticated remote attacker sends a specially crafted HTTP POST request to the vulnerable /c6/Jhsoft.Web
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.
Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Jinher OA 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Jinher OA 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Jinher OA up to 1.2. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Agiloft Release 28 contains an XML External Entities vulnerability in any table that allows 'import/export', allowing an authenticated attacker to import the template file and perform path traversal. Rated low severity (CVSS 2.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Delta Electronics EIP Builder version 1.11 is vulnerable to a File Parsing XML External Entity Processing Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
OpenKilda is an open-source OpenFlow controller. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
XML External Entity (XXE) processing vulnerability in Jinher OA 1.1 allows unauthenticated remote attackers to read local files or perform server-side request forgery via the XmlHttp.aspx endpoint. Public exploit code is available, though no active exploitation has been reported and EPSS indicates low exploitation probability.
XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and potentially exfiltrate data via the ProjectScheduleDelete.aspx endpoint. Exploit code is publicly available, but the EPSS exploitation probability remains low (0.07%) and the vulnerability is not known to be actively exploited.
XML External Entity (XXE) injection in agorum core open's RSSReader endpoint enables remote attackers to exfiltrate sensitive server-side data by submitting crafted XML payloads. Affected versions are v11.9.2 and v11.10.1 of this document management platform. EPSS exploitation probability sits at 0.22% (13th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA's KEV catalog - indicating low observed exploitation pressure despite the network-accessible, unauthenticated attack surface described by the CVSS vector.
Apache Jackrabbit versions prior to 2.23.2 contain blind XXE (XML External Entity) vulnerabilities in jackrabbit-spi-commons and jackrabbit-core components due to unsafe XML document parsing when loading privilege definitions. An authenticated attacker with low privileges can exploit this to achieve high-impact confidentiality, integrity, and availability compromise. The vulnerability requires user authentication (PR:L) but has no interaction requirement and affects all systems regardless of scope.
CVE-2025-7523 is an XML External Entity (XXE) injection vulnerability in Jinher OA 1.0 affecting the /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx endpoint. An unauthenticated remote attacker can exploit this to read sensitive files, modify data, or cause denial of service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-6438 is a security vulnerability (CVSS 5.9). Remediation should follow standard vulnerability management procedures.
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interaction. The vulnerable component is restricted to internal IP addresses.
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service by bypassing security measures. Exploitation of this issue does not require user interaction and scope is changed. The vulnerable component is restricted to internal IP addresses.
CVE-2025-49493 is a security vulnerability (CVSS 5.8) that allows file inclusion. Remediation should follow standard vulnerability management procedures.
Allure 2 versions prior to 2.34.1 contain a critical XML External Entity (XXE) injection vulnerability in the xunit-xml-plugin that allows unauthenticated remote attackers to read arbitrary files from the server's filesystem and potentially trigger SSRF attacks. The vulnerability stems from insecure XML parser configuration in the DocumentBuilderFactory and is exploitable by uploading or providing malicious test result XML files without any authentication or user interaction required.
PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is com.powsybl.commons.xml.XmlReader which is considered to be untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users perhaps with different privilege levels. This issue has been patched in com.powsybl:powsybl-commons: 6.7.2.
IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 contain an XML External Entity (XXE) injection vulnerability that allows authenticated remote attackers to extract sensitive information or trigger denial-of-service conditions through memory exhaustion. The vulnerability requires valid credentials (CVSS PR:L) but has a high confidentiality impact (C:H) and affects a critical security infrastructure product. No publicly available evidence of active exploitation or public POCs has been confirmed at this time.
CVE-2025-36049 is a security vulnerability (CVSS 8.8). High severity vulnerability requiring prompt remediation.
Keyoti SearchUnit versions prior to 9.0.0 contain an XML External Entity (XXE) injection vulnerability that allows unauthenticated remote attackers to exfiltrate sensitive files from affected systems. The vulnerability has a CVSS 3.1 score of 7.5 (High) with a network attack vector, no privileges required, and no user interaction needed. While no public POC or active in-the-wild exploitation has been widely documented, the straightforward attack vector and high confidentiality impact make this a significant risk for organizations running vulnerable SearchUnit instances.
A remote code execution vulnerability in GeoServer (CVSS 9.9) that allows users. Risk factors: public PoC available. Vendor patch is available.
CVE-2025-31039 is an XML External Entity (XXE) injection vulnerability in the Pixelgrade Category Icon WordPress plugin (versions through 1.0.2) that allows authenticated attackers with high privileges to read arbitrary files, execute remote code, or cause denial of service through improper XML entity validation. The vulnerability has a critical CVSS score of 9.1 but requires administrator-level privileges to exploit; active exploitation status and proof-of-concept availability are not confirmed from the provided intelligence.
CVE-2025-5877 is a security vulnerability (CVSS 6.3). Risk factors: public PoC available.
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Lantronix Device installer is vulnerable to XML external entity (XXE) attacks in configuration files read from the network device. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
1.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sulu is an open-source PHP content management system based on the Symfony framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 24.6%.
SysAid On-Prem contains a second unauthenticated XXE injection in Server URL processing, providing an alternative attack path to the Checkin XXE (CVE-2025-2775) for admin takeover.