Weaknesses of type CWE-611

649 results

Processamento inseguro de XML externo (XXE)

Ocorre quando uma aplicação processa XML sem desabilitar a resolução de entidades externas, permitindo que um atacante injete referências a arquivos locais ou recursos remotos. O parser XML carrega esses recursos e expõe seu conteúdo ou causa negação de serviço, comprometendo confidencialidade e disponibilidade.

Example

Um endpoint de API aceita XML do usuário e o processa com um parser padrão. Um atacante envia um payload XXE que referencia `/etc/passwd` via entity declaration, e o parser retorna o conteúdo do arquivo na resposta ou em logs. Alternativa: bomb XML que incha exponencialmente, travando o servidor.

How to mitigate

Desabilite explicitamente entidades externas e DTDs no parser XML (ex: `XMLConstants.FEATURE_SECURE_PROCESSING` em Java; `LIBXML_DISABLE_ENTITY_LOADER` em PHP). Valide e sanitize entrada XML; prefira JSON quando possível. Teste com payloads XXE conhecidos.

CVE-2026-41936HIGHVvveb < 1.0.8.2 XML External Entity Injection via ImportEPSS 0.3%CVE-2022-45386MEDIUMJenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.EPSS 0.3%CVE-2026-18061MEDIUMImproper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePluginEPSS 0.3%CVE-2025-26400MEDIUMSolarWinds Web Help Desk XML External Entity Injection (XXE) VulnerabilityEPSS 0.3%CVE-2026-91197HIGHFlowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactoryEPSS 0.3%CVE-2026-41895HIGHchangedetection.io: XXE vulnerability in the changedetection.io projectEPSS 0.3%CVE-2026-2252HIGHXML External Entity (XXE) vulnerability resulting in Server-Side Request Forgery (SSRF)EPSS 0.3%CVE-2026-12666HIGHIBM MQ Java messaging is vulnerable to XML external entity injectionEPSS 0.3%CVE-2026-1218MEDIUMBjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity referenceEPSS 0.3%CVE-2026-40882HIGHOpenRemote has XXE in Velbus Asset ImportEPSS 0.3%CVE-2022-41696MEDIUMCVE-2022-41696EPSS 0.3%CVE-2022-45121MEDIUMCVE-2022-45121EPSS 0.3%CVE-2022-43512MEDIUMCVE-2022-43512EPSS 0.3%CVE-2023-5136MEDIUMIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPXEPSS 0.3%CVE-2026-13275HIGHIBM MQ Managed File Transfer is vulnerable to XML external entity injectionEPSS 0.3%CVE-2026-18715MEDIUMIBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server LibertyEPSS 0.2%CVE-2026-71375HIGHXXE Vulnerability in Cosminexus Component ContainerEPSS 0.2%CVE-2025-36374MEDIUMIBM DataPower Gateway affected by XML external entity injectionEPSS 0.2%CVE-2023-3892MEDIUMUnsafe XML parsing of 3rd party DICOM private tags may lead to XXEEPSS 0.2%CVE-2022-21220HIGHImproper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user toEPSS 0.2%