Weaknesses of type CWE-611

649 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2025-52888HIGHAllure 2's xunit-xml-plugin Vulnerable to Improper XXE RestrictionEPSS 0.3%CVE-2026-15803HIGHIn Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-baseEPSS 0.3%CVE-2023-27527LOWShinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML fileEPSS 0.3%CVE-2026-16432HIGHDataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareEPSS 0.3%CVE-2026-82880HIGHYaCy Search Server through 1.941 XML External Entity Injection via ParsersEPSS 0.3%CVE-2026-69101HIGHDatavane TIS v5.0.0 XXE Injection via doEditWorkflow EndpointEPSS 0.3%CVE-2026-29924HIGHGrav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File EPSS 0.3%CVE-2024-5919MEDIUMPAN-OS: Authenticated XML External Entities (XXE) Injection VulnerabilityEPSS 0.3%CVE-2020-14478HIGHIMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611EPSS 0.3%CVE-2026-76572MEDIUMpkp pkp-lib XSLTransformer.php _transformPHP xml external entity referenceEPSS 0.3%CVE-2026-76427MEDIUMCisco ISE XML External Entity Injection VulnerabilityEPSS 0.3%CVE-2026-36765HIGHAn XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execEPSS 0.3%CVE-2026-55848HIGHmapfish-print: XXE on MapFish Print allows reading arbitrary files of certain typesEPSS 0.3%CVE-2026-16626CRITICALJasperReports Server: XXE Injection Vulnerability (Unauthenticated)EPSS 0.3%CVE-2025-64134HIGHJenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevEPSS 0.3%CVE-2025-15251MEDIUMbeecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity referenceEPSS 0.3%CVE-2025-66370MEDIUMKivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrateEPSS 0.3%CVE-2026-89212CRITICALXML External Entity in Akana API PlatformEPSS 0.3%CVE-2026-41066HIGHlxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local filesEPSS 0.3%CVE-2026-3511HIGHImproper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticEPSS 0.3%