Common Weakness Enumeration
CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1825 vulnerabilities reference this CWE, most recent first.
GHSA-HG4J-XGV6-PCR2
Vulnerability from github – Published: 2025-06-09 18:32 – Updated: 2026-04-01 18:35
VLAI
Details
Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon allows XML Entity Linking. This issue affects Category Icon: from n/a through 1.0.2.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-31039"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-09T16:15:36Z",
"severity": "CRITICAL"
},
"details": "Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon allows XML Entity Linking. This issue affects Category Icon: from n/a through 1.0.2.",
"id": "GHSA-hg4j-xgv6-pcr2",
"modified": "2026-04-01T18:35:24Z",
"published": "2025-06-09T18:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31039"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/category-icon/vulnerability/wordpress-category-icon-plugin-1-0-2-xml-external-entity-xxe-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HG4V-R4M7-XJ5J
Vulnerability from github – Published: 2025-01-07 18:30 – Updated: 2025-01-07 21:30
VLAI
Details
An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-46603"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T16:15:34Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) vulnerability in Elspec Engineering G5 Digital Fault Recorder Firmware v1.2.1.12 allows attackers to cause a Denial of Service (DoS) via a crafted XML payload.",
"id": "GHSA-hg4v-r4m7-xj5j",
"modified": "2025-01-07T21:30:55Z",
"published": "2025-01-07T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46603"
},
{
"type": "WEB",
"url": "https://www.elspec-ltd.com/support/security-advisories"
},
{
"type": "WEB",
"url": "http://elspec.com"
},
{
"type": "WEB",
"url": "http://g5.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HJ3G-VW9V-9WJ4
Vulnerability from github – Published: 2026-05-29 21:31 – Updated: 2026-05-29 21:31
VLAI
Details
In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
Severity
{
"affected": [],
"aliases": [
"CVE-2026-49383"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-29T19:16:28Z",
"severity": "LOW"
},
"details": "In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible",
"id": "GHSA-hj3g-vw9v-9wj4",
"modified": "2026-05-29T21:31:23Z",
"published": "2026-05-29T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49383"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HJ5J-C8QP-MGMV
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:02
VLAI
Details
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2018-20843"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-24T17:15:00Z",
"severity": "HIGH"
},
"details": "In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).",
"id": "GHSA-hj5j-c8qp-mgmv",
"modified": "2024-04-04T01:02:40Z",
"published": "2022-05-24T16:48:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20843"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/issues/186"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/pull/262"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2021-11"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4472"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4040-2"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4040-1"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K51011533"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190703-0001"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201911-08"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Jun/39"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00028.html"
},
{
"type": "WEB",
"url": "https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes"
},
{
"type": "WEB",
"url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HJF3-R7GW-9RWG
Vulnerability from github – Published: 2018-07-24 20:00 – Updated: 2024-09-20 17:15
VLAI
Summary
feedparser denial of service vulnerability
Details
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "feedparser"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-2921"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:40:30Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.",
"id": "GHSA-hjf3-r7gw-9rwg",
"modified": "2024-09-20T17:15:41Z",
"published": "2018-07-24T20:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2921"
},
{
"type": "WEB",
"url": "https://code.google.com/p/feedparser/source/browse/trunk/NEWS?spec=svn706\u0026r=706"
},
{
"type": "WEB",
"url": "https://code.google.com/p/feedparser/source/detail?r=703\u0026path=/trunk/feedparser/feedparser.py"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hjf3-r7gw-9rwg"
},
{
"type": "PACKAGE",
"url": "https://github.com/kurtmckee/feedparser"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/feedparser/PYSEC-2012-14.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20120604210617/http://www.securityfocus.com/bid/53654"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150523060531/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:118/?name=MDVSA-2013:118"
},
{
"type": "WEB",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0157"
},
{
"type": "WEB",
"url": "http://freecode.com/projects/feedparser/releases/344371"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "feedparser denial of service vulnerability"
}
GHSA-HJFH-2XPF-QMM3
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32
VLAI
Details
XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionTerminal or XG-X VisionTerminal is installed may be disclosed.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-82918"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:15Z",
"severity": "MODERATE"
},
"details": "XG VisionTerminal and XG-X VisionTerminal provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where XG VisionTerminal or XG-X VisionTerminal is installed may be disclosed.",
"id": "GHSA-hjfh-2xpf-qmm3",
"modified": "2026-09-03T15:32:16Z",
"published": "2026-09-03T15:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82918"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU98062224/index.html"
},
{
"type": "WEB",
"url": "https://www.keyence.com/mi26082104"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-HM3G-XJP2-HW8Q
Vulnerability from github – Published: 2022-05-14 03:47 – Updated: 2022-05-14 03:47
VLAI
Details
IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2017-1666"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-09T20:29:00Z",
"severity": "HIGH"
},
"details": "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540.",
"id": "GHSA-hm3g-xjp2-hw8q",
"modified": "2022-05-14T03:47:37Z",
"published": "2022-05-14T03:47:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1666"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/133560"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22011970"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102434"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HM59-JVM9-5VJ7
Vulnerability from github – Published: 2025-07-08 21:30 – Updated: 2025-07-08 21:30
VLAI
Details
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-49544"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T21:15:27Z",
"severity": "MODERATE"
},
"details": "ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue does not require user interaction and scope is changed.",
"id": "GHSA-hm59-jvm9-5vj7",
"modified": "2025-07-08T21:30:28Z",
"published": "2025-07-08T21:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49544"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb25-69.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HMHP-8P9W-M9G8
Vulnerability from github – Published: 2023-12-30 06:30 – Updated: 2024-01-05 21:30
VLAI
Details
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2023-52252"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-30T06:15:43Z",
"severity": "CRITICAL"
},
"details": "Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.",
"id": "GHSA-hmhp-8p9w-m9g8",
"modified": "2024-01-05T21:30:32Z",
"published": "2023-12-30T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52252"
},
{
"type": "WEB",
"url": "https://harkenzo.tlstickle.com/2023-03-17-UR-Web-Triggerable-RCE"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/51309"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HMQ6-FRV3-4727
Vulnerability from github – Published: 2018-10-18 17:43 – Updated: 2022-09-14 00:10
VLAI
Summary
jackson-dataformat-xml vulnerable to XML external entity (XXE)
Details
XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.fasterxml.jackson.dataformat:jackson-dataformat-xml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-3720"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:40:41Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.",
"id": "GHSA-hmq6-frv3-4727",
"modified": "2022-09-14T00:10:34Z",
"published": "2018-10-18T17:43:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3720"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hmq6-frv3-4727"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184561.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "jackson-dataformat-xml vulnerable to XML external entity (XXE)"
}
Mitigation
Implementation
System Configuration
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.