Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2024-55887HIGHUcum-java has an XXE vulnerability in XML parsingEPSS 0.6%CVE-2022-41967HIGHImproper Restriction of XML External Entity Reference in DragonflyEPSS 0.6%CVE-2021-47621HIGHClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.EPSS 0.6%CVE-2025-4641CRITICALXML External Entity (XXE) injection vulnerability in WebDriverManagerEPSS 0.6%CVE-2025-65482CRITICALAn XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploadinEPSS 0.6%CVE-2025-49535CRITICALColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2025-61813HIGHColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2025-10091MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.5%CVE-2025-10092MEDIUMJinher OA XML Type xml external entity referenceEPSS 0.5%CVE-2024-50442MEDIUMWordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerabilityEPSS 0.5%CVE-2025-10816MEDIUMJinher OA XML text xml external entity referenceEPSS 0.5%CVE-2022-39954MEDIUMAn improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.EPSS 0.5%CVE-2023-6147MEDIUMPossible XXE vulnerability in Jenkins Plugin for Qualys Policy ComplianceEPSS 0.5%CVE-2023-0871MEDIUMAn XML External Entity injection vulnerabilityEPSS 0.5%CVE-2016-15026MEDIUM3breadt dd-plist xml external entity referenceEPSS 0.5%CVE-2024-1167MEDIUMSEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity ReferenceEPSS 0.5%CVE-2025-48006HIGHImproper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request isEPSS 0.5%CVE-2022-50899HIGHGeonetwork 4.2.0 - XML External Entity (XXE)EPSS 0.5%CVE-2024-37388CRITICALAn XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitiveEPSS 0.5%CVE-2022-2838—In Eclipse Sphinx™ before version 0.13.1, Apache Xerces XML Parser was used without disabling processing of referenced external entities allEPSS 0.5%