Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2023-1288MEDIUMENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerabilityEPSS 0.5%CVE-2025-7824MEDIUMJinher OA XmlHttp.aspx xml external entity referenceEPSS 0.5%CVE-2025-7823MEDIUMJinher OA ProjectScheduleDelete.aspx xml external entity referenceEPSS 0.5%CVE-2024-36827HIGHAn XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensEPSS 0.5%CVE-2024-3969HIGH XML External Entity injection vulnerability in iManagerEPSS 0.5%CVE-2024-40075MEDIUMLaravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.EPSS 0.5%CVE-2023-3113HIGHAn unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resulEPSS 0.5%CVE-2024-25606HIGHXXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before uEPSS 0.5%CVE-2026-12752HIGHMultiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-12756HIGHMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026EPSS 0.5%CVE-2026-40682CRITICALApache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistorEPSS 0.5%CVE-2025-0162HIGHIBM Aspera Shares XML external entity injectionEPSS 0.5%CVE-2025-61823MEDIUMColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 0.5%CVE-2025-53689HIGHApache Jackrabbit: XXE vulnerability in jackrabbit-spi-commonsEPSS 0.5%CVE-2024-7098CRITICALXML Injection in SFS Consulting's ww.WinsureEPSS 0.5%CVE-2024-10218CRITICALTIBCO Hawk Stored-XEE VulnerabilityEPSS 0.5%CVE-2023-41369LOWExternal Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)EPSS 0.5%CVE-2025-36608MEDIUMDell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability.EPSS 0.5%CVE-2023-26058MEDIUMAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page. Input validation and a propeEPSS 0.5%CVE-2023-26057MEDIUMAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page. Input validation and aEPSS 0.5%