Weaknesses of type CWE-91

97 results

Injeção XML

Ocorre quando entrada do usuário é inserida diretamente em documentos XML sem validação ou escape, permitindo que um atacante injete tags, entidades ou estruturas maliciosas. O parser XML processa o conteúdo controlado como código, podendo expor dados sensíveis, desabilitar funcionalidades ou executar operações não autorizadas.

Example

Uma aplicação monta um XML de autenticação concatenando o nome de usuário direto: <usuario>'; </usuario><admin>true</admin><usuario>' vai resultar em um usuário com privilégios elevados. Ou um atacante injeta uma entidade externa que lê arquivos do servidor (XXE attack).

How to mitigate

Sempre usar bibliotecas de serialização XML que escapam automaticamente valores (como builders tipados), validar entrada com whitelist rigorosa, desabilitar processamento de entidades externas no parser XML, e nunca concatenar strings para montar XML. Considere usar APIs de manipulação que separam dados de estrutura.

CVE-2025-54251MEDIUMAdobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)EPSS 1.7%CVE-2019-17323—ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer withEPSS 1.6%CVE-2024-11622HIGHAn XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainEPSS 1.5%CVE-2024-25413CRITICALA XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to exeEPSS 1.5%CVE-2021-4140CRITICALIt was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 9EPSS 1.4%CVE-2024-51136CRITICALAn XML External Entity (XXE) vulnerability in Dmoz2CSV in openimaj v1.3.10 allows attackers to access sensitive information or execute arbitEPSS 1.2%CVE-2023-32173MEDIUMUnified Automation UaGateway AddServer XML Injection Denial-of-Service VulnerabilityEPSS 1.2%CVE-2023-38207HIGHAdobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system readEPSS 1.1%CVE-2024-28109HIGHPotential XSLT injection vulnerability when using policy filesEPSS 1.0%CVE-2023-22247HIGHAdobe Commerce XML Injection Arbitrary file system readEPSS 0.9%CVE-2022-32755MEDIUMIBM Security Directory Server external entity injectionEPSS 0.9%CVE-2023-29289MEDIUMAdobe Commerce XML Injection Security feature bypassEPSS 0.9%CVE-2021-27777HIGHHCL Unica Platform is vulnerable to XML External Entity (XXE) injectionEPSS 0.8%CVE-2022-2458—XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. ThiEPSS 0.8%CVE-2022-35259HIGHXML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorizeEPSS 0.8%CVE-2022-27233MEDIUMXML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unautEPSS 0.7%CVE-2026-53582HIGHOPNsense: XPATH Injection can disclose any secret in config.xmlEPSS 0.7%CVE-2022-4245MEDIUMCodehaus-plexus: xml external entity (xxe) injectionEPSS 0.7%CVE-2021-22524MEDIUMDenial of service vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1EPSS 0.7%CVE-2022-22244MEDIUMJunos OS: Unauthenticated XPath Injection vulnerability in J-WebEPSS 0.6%