Fallos del tipo CWE-91

88 resultados

Injeção XML

Ocorre quando dados não validados de um usuário ou entrada externa são incorporados diretamente em um documento XML processado pela aplicação. Um atacante pode injetar tags, entidades ou estruturas XML malformadas para alterar a semântica do documento, contornar validações, executar XXE (XML External Entity), ou manipular lógica de negócio que depende do parsing XML.

Ejemplo

Um sistema de e-commerce que constrói um pedido em XML concatenando strings do usuário: `<pedido><cliente>` + nome_do_usuario + `</cliente></pedido>`. Se o nome for `</cliente><desconto>90%</desconto><cliente>`, a estrutura XML é corrompida e o pedido passa a ter um desconto não autorizado.

Cómo mitigar

Valide e escape rigorosamente toda entrada antes de inseri-la em XML usando bibliotecas de serialização segura (não concatenação de strings). Use schemas XML (XSD) para validar a estrutura esperada e desabilite processamento de entidades externas (XXE) no parser configurando as propriedades de segurança adequadas.

CVE-2026-83616HIGHxmldom: Processing Instruction Target Injection Bypasses requireWellFormedEPSS 0.3%CVE-2026-83605HIGHxmldom: Attribute name injection via setAttribute() bypasses requireWellFormedEPSS 0.3%CVE-2026-32870MEDIUMKirby has XML injection in its XML creator toolkitEPSS 0.3%CVE-2026-24329MEDIUMWildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.EPSS 0.3%CVE-2025-7473MEDIUMXML InjectionEPSS 0.3%CVE-2026-83618HIGHxmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminatorEPSS 0.3%CVE-2026-83617HIGHxmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatorEPSS 0.3%CVE-2026-83609HIGHxmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathEPSS 0.3%CVE-2023-27328HIGHParallels Desktop Toolgate XML Injection Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-47273MEDIUMpam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queriesEPSS 0.3%CVE-2022-20729MEDIUMCisco Firepower Threat Defense Software XML Injection VulnerabilityEPSS 0.3%CVE-2026-2310HIGHIBM webMethods Integration Server is vulnerable to an XML external entity injection (XXE) attack when processing XML dataEPSS 0.3%CVE-2026-59728MEDIUM@astrojs/rss: XML Injection via Unescaped RSS Feed FieldsEPSS 0.3%CVE-2026-15037LOWXML injection vulnerability in QDom comment, CDATA and processing-instruction serializationEPSS 0.3%CVE-2025-47184MEDIUMAn XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 aEPSS 0.3%CVE-2026-41650MEDIUMfast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped DelimitersEPSS 0.2%CVE-2026-89247MEDIUMWWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpEPSS 0.2%CVE-2026-53723MEDIUMguzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA TerminatorEPSS 0.2%CVE-2026-11169HIGHInappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UEPSS 0.2%CVE-2026-44665MEDIUMfast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributesEPSS 0.2%