Weaknesses of type CWE-91

89 results

Injeção XML

Ocorre quando entrada do usuário é inserida diretamente em documentos XML sem validação ou escape, permitindo que um atacante injete tags, entidades ou estruturas maliciosas. O parser XML processa o conteúdo controlado como código, podendo expor dados sensíveis, desabilitar funcionalidades ou executar operações não autorizadas.

Example

Uma aplicação monta um XML de autenticação concatenando o nome de usuário direto: <usuario>'; </usuario><admin>true</admin><usuario>' vai resultar em um usuário com privilégios elevados. Ou um atacante injeta uma entidade externa que lê arquivos do servidor (XXE attack).

How to mitigate

Sempre usar bibliotecas de serialização XML que escapam automaticamente valores (como builders tipados), validar entrada com whitelist rigorosa, desabilitar processamento de entidades externas no parser XML, e nunca concatenar strings para montar XML. Considere usar APIs de manipulação que separam dados de estrutura.

CVE-2025-25589HIGHAn XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackerEPSS 0.5%CVE-2024-33858MEDIUMAn issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_naEPSS 0.5%CVE-2025-1545HIGHWatchGuard Firebox XPath Injection Vulnerability in Web CGIEPSS 0.5%CVE-2024-13190MEDIUMZeroWdd myblog BlogMapper.xml xml injectionEPSS 0.5%CVE-2026-32870MEDIUMKirby has XML injection in its XML creator toolkitEPSS 0.5%CVE-2025-9375MEDIUMxmltodict 0.14.2 - XML InjectionEPSS 0.4%CVE-2026-15037LOWXML injection vulnerability in QDom comment, CDATA and processing-instruction serializationEPSS 0.4%CVE-2023-40612MEDIUMAuthenticated XXE Injection Via The File EditorEPSS 0.4%CVE-2026-47273MEDIUMpam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriesEPSS 0.4%CVE-2026-55789HIGHLogto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service ProvidersEPSS 0.4%CVE-2026-59728MEDIUM@astrojs/rss: XML Injection via Unescaped RSS Feed FieldsEPSS 0.4%CVE-2026-89247MEDIUMWWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpEPSS 0.4%CVE-2025-60833MEDIUMAn XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary codEPSS 0.4%CVE-2026-53723MEDIUMguzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA TerminatorEPSS 0.3%CVE-2025-7473MEDIUMXML InjectionEPSS 0.3%CVE-2023-27328HIGHParallels Desktop Toolgate XML Injection Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-27693MEDIUMtraccar allows XML injection in KML and GPX exportsEPSS 0.3%CVE-2026-41650MEDIUMfast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped DelimitersEPSS 0.3%CVE-2022-20729MEDIUMCisco Firepower Threat Defense Software XML Injection VulnerabilityEPSS 0.3%CVE-2025-47184MEDIUMAn XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 aEPSS 0.3%