Weaknesses of type CWE-91

97 results

Injeção XML

Ocorre quando entrada do usuário é inserida diretamente em documentos XML sem validação ou escape, permitindo que um atacante injete tags, entidades ou estruturas maliciosas. O parser XML processa o conteúdo controlado como código, podendo expor dados sensíveis, desabilitar funcionalidades ou executar operações não autorizadas.

Example

Uma aplicação monta um XML de autenticação concatenando o nome de usuário direto: <usuario>'; </usuario><admin>true</admin><usuario>' vai resultar em um usuário com privilégios elevados. Ou um atacante injeta uma entidade externa que lê arquivos do servidor (XXE attack).

How to mitigate

Sempre usar bibliotecas de serialização XML que escapam automaticamente valores (como builders tipados), validar entrada com whitelist rigorosa, desabilitar processamento de entidades externas no parser XML, e nunca concatenar strings para montar XML. Considere usar APIs de manipulação que separam dados de estrutura.

CVE-2020-0646CRITICALA remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote EPSS 99.2%KEVCVE-2023-46214HIGHRemote code execution (RCE) in Splunk Enterprise through Insecure XML ParsingEPSS 89.2%CVE-2024-53675HIGHAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainEPSS 81.0%CVE-2024-53674HIGHAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainEPSS 46.7%CVE-2019-17626CRITICALReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document EPSS 9.5%CVE-2022-25356MEDIUMAlt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection.EPSS 5.7%CVE-2022-34253CRITICALAdobe Commerce XML Injection Arbitrary code executionEPSS 5.2%CVE-2019-25137HIGHUmbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSeleEPSS 4.1%CVE-2021-21019CRITICALMagento Commerce XML Injection Could Lead To Remote Code ExecutionEPSS 3.8%CVE-2021-21025CRITICALMagento Commerce XML Injection Could Lead To Arbitrary Code ExecutionEPSS 3.4%CVE-2021-36033CRITICALMagento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code ExecutionEPSS 3.1%CVE-2021-36028CRITICALMagento Commerce XML Injection Vulnerability Could Lead To Remote Code ExecutionEPSS 2.9%CVE-2021-36020HIGHMagento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code ExecutionEPSS 2.7%CVE-2025-49538HIGHColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)EPSS 2.4%CVE-2020-8479CRITICALABB Central Licensing System - XML External Entity InjectionEPSS 2.3%CVE-2026-76979HIGHXML Injection vulnerabilityEPSS 2.1%CVE-2021-32758HIGHLayout XML Arbitrary Code FixEPSS 2.0%CVE-2022-46751HIGHApache Ivy: XML External Entity vulnerability in Apache IvyEPSS 2.0%CVE-2026-102116HIGHKiteworks Email Protection Gateway Path TraversalEPSS 2.0%CVE-2021-39181HIGHUnsafe Deserialization of User Data Using XStreamEPSS 1.9%