Weaknesses of type CWE-91

97 results

Injeção XML

Ocorre quando entrada do usuário é inserida diretamente em documentos XML sem validação ou escape, permitindo que um atacante injete tags, entidades ou estruturas maliciosas. O parser XML processa o conteúdo controlado como código, podendo expor dados sensíveis, desabilitar funcionalidades ou executar operações não autorizadas.

Example

Uma aplicação monta um XML de autenticação concatenando o nome de usuário direto: <usuario>'; </usuario><admin>true</admin><usuario>' vai resultar em um usuário com privilégios elevados. Ou um atacante injeta uma entidade externa que lê arquivos do servidor (XXE attack).

How to mitigate

Sempre usar bibliotecas de serialização XML que escapam automaticamente valores (como builders tipados), validar entrada com whitelist rigorosa, desabilitar processamento de entidades externas no parser XML, e nunca concatenar strings para montar XML. Considere usar APIs de manipulação que separam dados de estrutura.

CVE-2026-83616HIGHxmldom: Processing Instruction Target Injection Bypasses requireWellFormedEPSS 0.6%CVE-2026-83607HIGHxmldom: Element name injection via createElement() bypasses requireWellFormedEPSS 0.6%CVE-2026-83608HIGHxmldom: DocType `name` Injection Bypasses requireWellFormedEPSS 0.6%CVE-2026-83605HIGHxmldom: Attribute name injection via setAttribute() bypasses requireWellFormedEPSS 0.6%CVE-2024-47113HIGHIBM ICP - Voice Gateway XML injectionEPSS 0.6%CVE-2026-24329MEDIUMWildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.EPSS 0.6%CVE-2025-66034MEDIUMfontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLibEPSS 0.6%CVE-2025-12921MEDIUMOpenClinica Community Edition CRF Data Import ImportCRFData xml injectionEPSS 0.6%CVE-2026-83617HIGHxmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatorEPSS 0.6%CVE-2026-83618HIGHxmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminatorEPSS 0.6%CVE-2026-41674HIGHxmldom: XML injection through unvalidated DocumentType serializationEPSS 0.6%CVE-2025-24404HIGHApache HertzBeat (incubating): RCE by parse http sitemap xml responseEPSS 0.6%CVE-2026-83609HIGHxmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathEPSS 0.5%CVE-2024-42374HIGHXML injection in SAP BEx Web Java Runtime Export Web ServiceEPSS 0.5%CVE-2025-1545HIGHWatchGuard Firebox XPath Injection Vulnerability in Web CGIEPSS 0.5%CVE-2026-40165HIGHauthentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier TruncationEPSS 0.5%CVE-2023-35858MEDIUMXPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker toEPSS 0.5%CVE-2024-13190MEDIUMZeroWdd myblog BlogMapper.xml xml injectionEPSS 0.5%CVE-2026-34601HIGHxmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionEPSS 0.5%CVE-2025-25589HIGHAn XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackerEPSS 0.5%