Fallos del tipo CWE-91

88 resultados

Injeção XML

Ocorre quando dados não validados de um usuário ou entrada externa são incorporados diretamente em um documento XML processado pela aplicação. Um atacante pode injetar tags, entidades ou estruturas XML malformadas para alterar a semântica do documento, contornar validações, executar XXE (XML External Entity), ou manipular lógica de negócio que depende do parsing XML.

Ejemplo

Um sistema de e-commerce que constrói um pedido em XML concatenando strings do usuário: `<pedido><cliente>` + nome_do_usuario + `</cliente></pedido>`. Se o nome for `</cliente><desconto>90%</desconto><cliente>`, a estrutura XML é corrompida e o pedido passa a ter um desconto não autorizado.

Cómo mitigar

Valide e escape rigorosamente toda entrada antes de inseri-la em XML usando bibliotecas de serialização segura (não concatenação de strings). Use schemas XML (XSD) para validar a estrutura esperada e desabilite processamento de entidades externas (XXE) no parser configurando as propriedades de segurança adequadas.

CVE-2022-22244MEDIUMJunos OS: Unauthenticated XPath Injection vulnerability in J-WebEPSS 0.5%CVE-2026-41674HIGHxmldom: XML injection through unvalidated DocumentType serializationEPSS 0.5%CVE-2025-24404HIGHApache HertzBeat (incubating): RCE by parse http sitemap xml responseEPSS 0.5%CVE-2026-40165HIGHauthentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier TruncationEPSS 0.5%CVE-2023-35858MEDIUMXPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker toEPSS 0.5%CVE-2025-25589HIGHAn XML external entity (XXE) injection vulnerability in the component /weixin/aes/XMLParse.java of yimioa before v2024.07.04 allows attackerEPSS 0.5%CVE-2024-33858MEDIUMAn issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_naEPSS 0.5%CVE-2025-1545HIGHWatchGuard Firebox XPath Injection Vulnerability in Web CGIEPSS 0.5%CVE-2024-13190MEDIUMZeroWdd myblog BlogMapper.xml xml injectionEPSS 0.5%CVE-2026-34601HIGHxmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionEPSS 0.5%CVE-2026-41675HIGHxmldom: XML node injection through unvalidated processing instruction serializationEPSS 0.5%CVE-2026-46490HIGHsamlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML AssertionsEPSS 0.5%CVE-2025-9375MEDIUMxmltodict 0.14.2 - XML InjectionEPSS 0.4%CVE-2023-40612MEDIUMAuthenticated XXE Injection Via The File EditorEPSS 0.4%CVE-2026-55789HIGHLogto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service ProvidersEPSS 0.4%CVE-2026-28770MEDIUMXML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101EPSS 0.4%CVE-2026-41672HIGHxmldom: XML node injection through unvalidated comment serializationEPSS 0.4%CVE-2025-60833MEDIUMAn XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary codEPSS 0.4%CVE-2026-83608HIGHxmldom: DocType `name` Injection Bypasses requireWellFormedEPSS 0.3%CVE-2026-83607HIGHxmldom: Element name injection via createElement() bypasses requireWellFormedEPSS 0.3%