Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.6%CVE-2025-7523MEDIUMJinher OA DelTemp.aspx xml external entity referenceEPSS 0.6%CVE-2023-45612HIGHIn JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXEEPSS 0.6%CVE-2020-26066MEDIUMCisco SD-WAN vManage Software XML External Entity VulnerabilityEPSS 0.6%CVE-2023-28828MEDIUMA vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Entity Injection (XXE) vEPSS 0.6%CVE-2024-38374HIGHImproper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-javaEPSS 0.6%CVE-2022-37911LOWDue to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit cEPSS 0.6%CVE-2024-21255HIGHVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Supported versions that are EPSS 0.6%CVE-2026-24400HIGHAssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertionEPSS 0.6%CVE-2022-3340MEDIUMTrellix IPS Manager vulnerable to XXEEPSS 0.6%CVE-2023-21862HIGHVulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported veEPSS 0.6%CVE-2026-45071HIGHSymfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = trueEPSS 0.6%CVE-2023-28682HIGHJenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%CVE-2026-55471HIGHHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactoryEPSS 0.6%CVE-2023-28681HIGHJenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%CVE-2023-28683HIGHJenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.6%CVE-2024-46455CRITICALunstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.EPSS 0.6%CVE-2024-25971MEDIUMDell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker coEPSS 0.6%CVE-2024-52807HIGHXXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`EPSS 0.6%CVE-2022-20938MEDIUMA vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could alloEPSS 0.6%