Skip to content
OpenAdvisories

Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

  1. Implementation, System Configuration

    Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 8.2
    CVE-2025-58360 Exploited Public exploit EPSS 61%

    GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

    GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific end…

    geoserver geoserver org.geoserver.web:gs-web-app org.geoserver:gs-wms Maven
    KEV Dec 11, 2025
  • Critical 9.3
    CVE-2025-2776 Exploited Public exploit EPSS 65%

    SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.3
    CVE-2025-2775 Exploited Public exploit EPSS 43%

    SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

    SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.

    SysAid SysAid On-Prem
    KEV Jul 22, 2025
  • Critical 9.8
    CVE-2024-34102 Exploited Public exploit EPSS 100%

    XXE can expose crypt key and other secrets granting full admin access

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability …

    Adobe Adobe Commerce magento/community-edition Packagist
    KEV Jul 17, 2024
  • Critical 9.8
    CVE-2019-9670 Exploited Public exploit EPSS 100%

    mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (X…

    KEV Jan 10, 2022