Weaknesses of type CWE-91

97 results

Injeção XML

Ocorre quando entrada do usuário é inserida diretamente em documentos XML sem validação ou escape, permitindo que um atacante injete tags, entidades ou estruturas maliciosas. O parser XML processa o conteúdo controlado como código, podendo expor dados sensíveis, desabilitar funcionalidades ou executar operações não autorizadas.

Example

Uma aplicação monta um XML de autenticação concatenando o nome de usuário direto: <usuario>'; </usuario><admin>true</admin><usuario>' vai resultar em um usuário com privilégios elevados. Ou um atacante injeta uma entidade externa que lê arquivos do servidor (XXE attack).

How to mitigate

Sempre usar bibliotecas de serialização XML que escapam automaticamente valores (como builders tipados), validar entrada com whitelist rigorosa, desabilitar processamento de entidades externas no parser XML, e nunca concatenar strings para montar XML. Considere usar APIs de manipulação que separam dados de estrutura.

CVE-2024-33858MEDIUMAn issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_naEPSS 0.5%CVE-2026-102037CRITICALJunos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is usedEPSS 0.5%CVE-2026-41675HIGHxmldom: XML node injection through unvalidated processing instruction serializationEPSS 0.5%CVE-2026-46490HIGHsamlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML AssertionsEPSS 0.5%CVE-2026-110084HIGHAdobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)EPSS 0.5%CVE-2025-9375MEDIUMxmltodict 0.14.2 - XML InjectionEPSS 0.5%CVE-2026-41672HIGHxmldom: XML node injection through unvalidated comment serializationEPSS 0.5%CVE-2026-15037LOWXML injection vulnerability in QDom comment, CDATA and processing-instruction serializationEPSS 0.4%CVE-2026-65124MEDIUMNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of EPSS 0.4%CVE-2026-103044CRITICALEasyTimeline should not serve image maps as application/xmlEPSS 0.4%CVE-2023-40612MEDIUMAuthenticated XXE Injection Via The File EditorEPSS 0.4%CVE-2026-28770MEDIUMXML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101EPSS 0.4%CVE-2026-89247MEDIUMWWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpEPSS 0.4%CVE-2025-60833MEDIUMAn XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary codEPSS 0.4%CVE-2026-32870MEDIUMKirby has XML injection in its XML creator toolkitEPSS 0.3%CVE-2026-55789HIGHLogto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service ProvidersEPSS 0.3%CVE-2025-7473MEDIUMXML InjectionEPSS 0.3%CVE-2026-59728MEDIUM@astrojs/rss: XML Injection via Unescaped RSS Feed FieldsEPSS 0.3%CVE-2023-27328HIGHParallels Desktop Toolgate XML Injection Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-47273MEDIUMpam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriesEPSS 0.3%