Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2023-24466HIGHPossible XML External Entity Injection in OpenText iManagerEPSS 0.5%CVE-2022-43941HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference EPSS 0.5%CVE-2025-11341MEDIUMJinher OA type xml external entity referenceEPSS 0.5%CVE-2025-31039CRITICALWordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerabilityEPSS 0.5%CVE-2025-61821MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2026-49875MEDIUMApache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtilsEPSS 0.5%CVE-2024-51445HIGHA vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contEPSS 0.5%CVE-2025-27136MEDIUMLocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) InjectionEPSS 0.5%CVE-2025-32138MEDIUMWordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerabilityEPSS 0.5%CVE-2022-4818MEDIUMTalend Open Studio for MDM SystemStorageWrapper.java xml external entity referenceEPSS 0.5%CVE-2023-26267MEDIUMphp-saml-sp before 1.1.1 and 2.x before 2.1.1 allows reading arbitrary files as the webserver user because resolving XML external entities wEPSS 0.5%CVE-2023-7307HIGHSangfor Behavior Management System XML External Entity InjectionEPSS 0.5%CVE-2023-26461MEDIUMXML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)EPSS 0.5%CVE-2026-51080CRITICALlibpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%CVE-2023-47160HIGHIBM Cognos Controller XML external entity injectionEPSS 0.5%CVE-2024-24743HIGHXXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)EPSS 0.5%CVE-2025-32406HIGHAn XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch EPSS 0.5%CVE-2021-42537MEDIUMVISAM VBASE Editor Improper Restriction of XMLEPSS 0.5%CVE-2025-6985HIGHXXE Vulnerability in langchain-ai/langchainEPSS 0.5%CVE-2022-3338MEDIUMXXE in Trellix ePO serverEPSS 0.5%