Weaknesses of type CWE-611

648 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2023-30951MEDIUMCVE-2023-30951 EPSS 0.5%CVE-2025-47778MEDIUMSulu vulnerable to XXE in SVG File upload InspectorEPSS 0.4%CVE-2024-39847HIGHArbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAPEPSS 0.4%CVE-2023-37233HIGHLoftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.EPSS 0.4%CVE-2025-24911MEDIUMHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2023-43067MEDIUM Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerabilityEPSS 0.4%CVE-2024-47582MEDIUMXML Entity Expansion Vulnerability in SAP NetWeaver AS JAVAEPSS 0.4%CVE-2026-8396HIGHXXE in Netcad's NetGISEPSS 0.4%CVE-2025-47293LOWPowSyBl Core XML Reader allows XXE and SSRFEPSS 0.4%CVE-2024-45072MEDIUMIBM WebSphere Application Server XML external entity injectionEPSS 0.4%CVE-2024-45086MEDIUMIBM WebSphere Application Server XML external entity injectionEPSS 0.4%CVE-2026-12975HIGHApicurio/apicurio-registry: apicurio-registry: unhardened saxparser in content-type detection leads to blind xxe / ssrf / billion-laughs dosEPSS 0.4%CVE-2026-78224HIGHNextGen Healthcare Mirth Connect Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2023-4554MEDIUMXML External Entity (XXE) ProcessingEPSS 0.4%CVE-2024-52806HIGHSimpleSAMLphp SAML2 has an XXE in parsing SAML messagesEPSS 0.4%CVE-2018-25142HIGHNovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity InjectionEPSS 0.4%CVE-2025-25036MEDIUMJalios JPlatform 10 Authenticated XML External Entity Injection (XXE)EPSS 0.4%CVE-2025-14478HIGHDemo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File UploadEPSS 0.4%CVE-2024-28198MEDIUMXML external entity (XXE) injection in OpenOLATEPSS 0.4%CVE-2026-94108HIGHgetID3 through 1.9.26 XML External Entity Injection via XML2arrayEPSS 0.4%