Skip to content
OpenAdvisories

Weakness (CWE)

CWE-112: Missing XML Validation

Base Draft

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Always validate XML input against a known XML Schema or DTD.

    It is not possible for an XML parser to validate all aspects of a document's content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed.

Source: MITRE CWE-112

All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Low 3.1
    CVE-2026-1190

    Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata

    A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an a…

    Red Hat Red Hat Single Sign-On 7 Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat build of Keycloak 26.4 Maven
  • High 8.1
    CVE-2025-68493 Public exploit EPSS 50%

    Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core org.apache.struts.xwork:xwork-core Maven
  • Medium 6.5
    CVE-2023-40310

    Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import

    SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could i…

    SAP_SE SAP PowerDesigner Client
  • Medium 5.3
    CVE-2021-27780

    HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction

    The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.

    HCL Software HCL BigFix Mobile / Modern Client Management
  • Unscored —
    CVE-2022-28213 Public exploit EPSS 12%

    When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does …

    SAP_SE SAP BusinessObjects Business Intelligence Platform
  • Medium 6.3
    CVE-2021-1359

    Cisco Web Security Appliance Privilege Escalation Vulnerability

    A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient valida…

    Cisco Cisco Web Security Appliance (WSA) Network devices
  • Unscored —
    CVE-2020-27282

    In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allow…

  • Medium 6.8
    CVE-2020-1975

    Missing XML Validation in PAN-OS Web Interface

    Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 a…

    Palo Alto Networks PAN-OS Network devices
  • Medium —
    CVE-2014-0119

    Missing XML Validation in Apache Tomcat

    Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…

    org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • Medium —
    CVE-2013-7315

    Missing XML Validation in Spring Framework

    The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CS…

    libspring-java org.springframework:spring-oxm Debian Maven
  • Medium —
    CVE-2013-2160 Public exploit EPSS 32%

    Missing XML Validation in Apache CXF

    The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) n…

    org.apache.cxf:cxf-rt-frontend-jaxrs Maven
  • High —
    CVE-2013-4002 Public exploit EPSS 25%

    Missing XML Validation in Apache Xerces2

    XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u6…

    xerces:xercesImpl Maven