Improper Restriction of XML External Entity Reference
CWE-611
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
We track 348 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 9 have been exploited in real attacks.
How this weakness is prevented
- Implementation System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.
Latest Improper Restriction of XML External Entity Reference vulnerabilities
- 7.1 High severity
Unisphere for PowerMax: Improper Restriction of XML External Entity Reference
Dell Unisphere for PowerMax, version(s) 9.2.4.x, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access to dat
- 7.4 High severity
ColdFusion: Improper Restriction of XML External Entity Reference
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensit
- 9.8 Critical severity
Apache Tika core: Improper Restriction of XML External Entity Reference
Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the
- 9.8 Critical severity
OSGeo GeoServer Improper Restriction of XML External Entity Reference Exploited
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endp
- 7.1 High severity
Pdfpatcher: Improper Restriction of XML External Entity Reference
PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entity (XXE) references. The application uses .NET's XmlDocument class without disabling external entity resolution, enabling attackers to: Read arbitrary
- 7.5 High severity
cyclonedx-core-java: Improper Restriction of XML External Entity Reference
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not conf
- 7.5 High severity
Metinfo: Improper Restriction of XML External Entity Reference
A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to const
- 9.1 Critical severity
WSO2 Enterprise Integrator: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successf
- 9.1 Critical severity
InfoSphere Information Server: Improper Restriction of XML External Entity Reference
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 7.1 High severity
Jenkins JDepend Plugin: Improper Restriction of XML External Entity Reference
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
- 7.5 High severity
langchain-ai/langchain: Improper Restriction of XML External Entity Reference
The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed us
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote explo
- 9.1 Critical severity
DataSpider Servista: Improper Restriction of XML External Entity Reference
Improper restriction of XML external entity reference issue exists in DataSpider Servista 4.4 and earlier. If a specially crafted request is processed, arbitrary files on the file system where the server application for the product is installed may be read, or
- 9.8 Critical severity
Zhiyou ERP: Improper Restriction of XML External Entity Reference
A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. Affected by this vulnerability is the function openForm of the component com.artery.richclient.RichClientService. Such manipulation of the argument contentString leads to xml external entity refer
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated rem
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A security flaw has been discovered in Jinher OA 2.0. This affects an unknown part of the file /c6/Jhsoft.Web.module/ToolBar/GetWordFileName.aspx/?text=GetUrl&style=add of the component XML Handler. Performing manipulation results in xml external entity refere
- 9.1 Critical severity
TecConnect: Improper Restriction of XML External Entity Reference
A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability was found in Jinher OA up to 1.2. This impacts an unknown function of the file /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx/?Type=add of the component XML Handler. The manipulation results in xml external entity reference. The attack ca
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability has been found in Jinher OA up to 1.2. This affects an unknown function of the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add of the component XML Handler. The manipulation leads to xml external entity reference. Remote
- 8.7 High severity
Sangfor Behavior Management System (DC…: Improper Restriction of XML External Entity Reference
Sangfor Behavior Management System (also referred to as DC Management System in Chinese-language documentation) contains an XML external entity (XXE) injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafte
- 8.4 High severity
Apache Tika PDF parser module: Improper Restriction of XML External Entity Reference
Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitiv
- 8.2 High severity
Universal Print Driver: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.
- 7.5 High severity
FreeFlow Core: Improper Restriction of XML External Entity Reference
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).
- 8.6 High severity
Adobe Experience Manager: Improper Restriction of XML External Entity Reference
Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive
- 9.8 Critical severity
MagicINFO 9 Server: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue affects MagicINFO 9 Server: less than 21.1080.0.
- 8.0 High severity
Provisioning Manager: Improper Restriction of XML External Entity Reference
Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to unauthenticated remote code execution on hosts with Provisioning Manager installed.
- 9.8 Critical severity
OA: Improper Restriction of XML External Entity Reference
A vulnerability was found in Jinher OA 1.1. It has been rated as problematic. This issue affects some unknown processing of the file XmlHttp.aspx. The manipulation leads to xml external entity reference. The attack may be initiated remotely. The exploit has be
- 9.8 Critical severity
OA: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in Jinher OA 1.2. It has been declared as problematic. This vulnerability affects unknown code of the file ProjectScheduleDelete.aspx. The manipulation leads to xml external entity reference. The attack can be initiated remotely. The
- 8.8 High severity
Apache Jackrabbit: Improper Restriction of XML External Entity Reference
Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges. Users are recommended to upgrade to versions 2.20.17 (Java 8), 2.22.1 (Java 11) or 2.23.2 (Jav
- 9.8 Critical severity
OA: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability was found in Jinher OA 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /c6/Jhsoft.Web.message/ToolBar/DelTemp.aspx. The manipulation leads to xml external entity reference. The attack may be l
- 9.3 Critical severity
ColdFusion: Improper Restriction of XML External Entity Reference
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensi
- 7.5 High severity
allure2: Improper Restriction of XML External Entity Reference
Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XM
- 7.1 High severity
QRadar SIEM: Improper Restriction of XML External Entity Reference
IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- 8.8 High severity
webMethods Integration Server: Improper Restriction of XML External Entity Reference
IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands.
- 9.1 Critical severity
geoserver: Improper Restriction of XML External Entity Reference
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML pro
- 8.2 High severity
geoserver: Exposure of Sensitive Information to an Unauthorized Actor
GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP serve
- 9.1 Critical severity
Category Icon: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through <= 1.0.3.
- 8.1 High severity
Feng Office: Externally Controlled Reference to a Resource in Another Sphere
A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handle
- 8.7 High severity
Math: Improper Restriction of XML External Entity Reference
PHPOffice Math is a library that provides a set of classes to manipulate different formula file formats. Prior to version 0.3.0, loading XML data using the standard `libxml` extension and the `LIBXML_DTDLOAD` flag without additional filtration, leads to XXE. V
- 8.7 High severity
JP1/IT Desktop Management 2 - Smart Device…: Improper Restriction of XML External Entity Reference
XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 t