Weaknesses of type CWE-611

649 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2026-18172HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2025-66371MEDIUMPeppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read EPSS 0.3%CVE-2026-79572HIGHAn XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive filEPSS 0.3%CVE-2026-54078HIGHveraPDF Validation XXE via Rich TextEPSS 0.3%CVE-2026-54079HIGHveraPDF Validation XXE via XFAEPSS 0.3%CVE-2023-41365MEDIUMInformation Disclosure vulnerability in SAP Business One (B1i)EPSS 0.3%CVE-2023-6194LOWIn Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) rEPSS 0.3%CVE-2025-68463MEDIUMBio.Entrez in Biopython through 186 allows doctype XXE.EPSS 0.3%CVE-2026-21569HIGHThis High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server. ThEPSS 0.3%CVE-2026-42212HIGHSolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parserEPSS 0.3%CVE-2024-3930MEDIUMXML External Entity in AkanaEPSS 0.3%CVE-2026-1567HIGHIBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerabilityEPSS 0.3%CVE-2025-36247HIGHIBM Db2 XML External Entity ReferenceEPSS 0.3%CVE-2025-35112MEDIUMAgiloft XML external entity local path traversalEPSS 0.3%CVE-2026-2536MEDIUMopencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity referenceEPSS 0.3%CVE-2026-54470MEDIUMDell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerabilityEPSS 0.3%CVE-2026-76446MEDIUMCisco Identity Services Engine External Entity Injection VulnerabilityEPSS 0.3%CVE-2025-46425MEDIUMDell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerabEPSS 0.3%CVE-2026-44618MEDIUMApache CXF: XXE vulnerability in WS-Transfer functionalityEPSS 0.3%CVE-2026-46722MEDIUMXML External Entity Injection in extension "Faceted Search" (ke_search)EPSS 0.3%