Skip to content
OpenAdvisories

Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

  1. Implementation, System Configuration

    Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.5
    CVE-2026-20320 Exploited

    A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remot…

    Cisco Cisco BroadWorks Network devices
    KEV Nov 10, 2026
  • High 8.2
    CVE-2025-58360 Exploited Public exploit EPSS 61%

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
    KEV Dec 11, 2025
  • Critical 9.3
    CVE-2025-2776 Exploited Public exploit EPSS 65%

    SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.3
    CVE-2025-2775 Exploited Public exploit EPSS 43%

    SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.8
    CVE-2024-34102 Exploited Public exploit EPSS 100%

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability …

    Adobe Adobe Commerce magento/community-edition Packagist
    KEV Jul 17, 2024
  • High 7.5
    CVE-2023-45727 Exploited

    Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail …

    North Grid Proself Gateway Edition Proself Enterprise/Standard Edition Proself Mail Sanitize Edition
    KEV Dec 3, 2024
  • High 7.5
    CVE-2019-13608 Exploited · Ransomware EPSS 30%

    Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE a…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2019-9670 Exploited Public exploit EPSS 100%

    mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (X…

    KEV Jan 10, 2022
  • Medium 6.5
    CVE-2016-9563 Exploited EPSS 24%

    BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) atta…

    KEV Nov 3, 2021