Skip to content
OpenAdvisories

Weakness (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

Base Draft

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it (1 mitigation)

  1. Implementation, System Configuration

    Many XML parsers and validators can be configured to disable external entity expansion.

Source: MITRE CWE-611

All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-91858 Public exploit

    Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present

    FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's …

    Apache Software Foundation Apache Camel
  • Medium 5.5
    CVE-2026-6807 Public exploit

    NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

    A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.

    NSA GRASSMARLIN
  • Medium 5.8
    CVE-2025-49493 Public exploit

    Akamai CloudTest before 60 2025.06.02 (12988) allows file inclusion via XML External Entity (XXE) injection.

    Akamai CloudTest
  • Medium 5.5
    CVE-2025-27136 Public exploit

    LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection

    LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity (XXE) injection. When processing the CreateBucketConfiguration XML document duri…

    Robothy local-s3 io.github.robothy:local-s3-rest Maven
  • Medium 6.5
    CVE-2024-50848 Public exploit

    An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldS…

  • Medium 6.5
    CVE-2024-30043 Public exploit EPSS 56%

    Microsoft SharePoint Server Information Disclosure Vulnerability

    Microsoft SharePoint Server Information Disclosure Vulnerability

    Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition
  • Medium 6.8
    CVE-2023-38490 Public exploit

    Kirby XML External Entity (XXE) vulnerability in the XML data handler

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plu…

    getkirby kirby getkirby/cms Packagist
  • Medium 5.3
    CVE-2023-20052 Public exploit

    On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG f…

    Cisco Cisco Secure Endpoint clamav clamav Network devices Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2022-0219 Public exploit

    Improper Restriction of XML External Entity Reference in skylot/jadx

    Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.

    skylot skylot/jadx io.github.skylot:jadx-core Maven
  • Medium 5.5
    CVE-2019-17554 Public exploit EPSS 12%

    Improper Restriction of XML External Entity Reference in Apache Olingo

    The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger…

    Apache Olingo org.apache.olingo:odata-client-core org.apache.olingo:odata-server-core Maven
  • Medium 5.9
    CVE-2019-10172 Public exploit EPSS 17%

    Improper Restriction of XML External Entity Reference in jackson-mapper-asl

    A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

    RedHat jackson-mapper-asl libjackson-json-java libjackson-json-java Debian Ubuntu Maven
  • Medium 4.9
    CVE-2019-1698 Public exploit

    Cisco IoT Field Network Director XML External Entity Vulnerability

    A vulnerability in the web-based user interface of Cisco Internet of Things Field Network Director (IoT-FND) Software could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The vulnerability is d…

    Cisco Cisco IoT Field Network Director (IoT-FND) Network devices
  • Medium —
    CVE-2015-5161 Public exploit

    ZendXml and Zend Framework contain XXE and XEE Vulnerabilities

    The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external e…

    zendframework/zendframework1 zendframework/zendframework zendframework/zendxml Packagist
  • Medium —
    CVE-2014-3004 Public exploit

    Improper Restriction of XML External Entity Reference in Castor

    The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.

    castor org.codehaus.castor:castor castor:castor Ubuntu Maven
  • Medium 6.5
    CVE-2011-4107 Public exploit EPSS 13%

    phpMyAdmin vulnerable to XML external entity (XXE) injection attack

    The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, …

    phpmyadmin phpmyadmin/phpmyadmin Debian Packagist