CWE-611
AllowedImproper Restriction of XML External Entity Reference
Abstraction: Base · Status: Draft
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
1827 vulnerabilities reference this CWE, most recent first.
GHSA-MQWP-H5CM-W625
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
{
"affected": [],
"aliases": [
"CVE-2026-70423"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:39Z",
"severity": "MODERATE"
},
"details": "Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.",
"id": "GHSA-mqwp-h5cm-w625",
"modified": "2026-08-19T15:32:27Z",
"published": "2026-08-19T15:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70423"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000500910/dsa-2026-359-security-update-for-dell-openmanage-enterprise-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MRC5-QWCP-HM9C
Vulnerability from github – Published: 2026-09-15 18:32 – Updated: 2026-09-15 18:32IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource.
{
"affected": [],
"aliases": [
"CVE-2026-12752"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T18:17:15Z",
"severity": "HIGH"
},
"details": "IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource.",
"id": "GHSA-mrc5-qwcp-hm9c",
"modified": "2026-09-15T18:32:35Z",
"published": "2026-09-15T18:32:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12752"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7285930"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-MRVG-P24W-MP92
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-04-12 12:47The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
{
"affected": [],
"aliases": [
"CVE-2015-3451"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-05-12T19:59:00Z",
"severity": "MODERATE"
},
"details": "The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.",
"id": "GHSA-mrvg-p24w-mp92",
"modified": "2025-04-12T12:47:43Z",
"published": "2022-05-13T01:27:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3451"
},
{
"type": "WEB",
"url": "https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2015-0199.html"
},
{
"type": "WEB",
"url": "http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3243"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:231"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/04/25/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/04/30/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74333"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2592-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MVHV-28QJ-949C
Vulnerability from github – Published: 2022-05-13 01:34 – Updated: 2022-05-13 01:34A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by convincing a user of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files within the affected application.
{
"affected": [],
"aliases": [
"CVE-2018-15444"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-08T18:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web-based user interface of Cisco Energy Management Suite Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by convincing a user of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files within the affected application.",
"id": "GHSA-mvhv-28qj-949c",
"modified": "2022-05-13T01:34:16Z",
"published": "2022-05-13T01:34:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15444"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-ems-xml-xxe"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2018-36"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105860"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MWXW-R5FQ-RX8V
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.
{
"affected": [],
"aliases": [
"CVE-2021-37425"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-10T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.",
"id": "GHSA-mwxw-r5fq-rx8v",
"modified": "2022-05-24T19:10:48Z",
"published": "2022-05-24T19:10:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37425"
},
{
"type": "WEB",
"url": "https://www.altova.com/mobiletogether"
},
{
"type": "WEB",
"url": "https://www.redteam-pentesting.de/advisories/rt-sa-2021-002"
},
{
"type": "WEB",
"url": "https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Aug/12"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-MXVX-H4RP-CJRC
Vulnerability from github – Published: 2022-05-13 01:54 – Updated: 2022-05-13 01:54UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.
{
"affected": [],
"aliases": [
"CVE-2018-1000837"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-20T15:29:00Z",
"severity": "CRITICAL"
},
"details": "UML Designer version \u003c= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via malicious plugins.xml file.",
"id": "GHSA-mxvx-h4rp-cjrc",
"modified": "2022-05-13T01:54:14Z",
"published": "2022-05-13T01:54:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000837"
},
{
"type": "WEB",
"url": "https://github.com/ObeoNetwork/UML-Designer/issues/1035"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/10/28/uml-designer-XXE"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P2HQ-X27F-8MX5
Vulnerability from github – Published: 2022-01-31 00:00 – Updated: 2022-02-05 00:00Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.
{
"affected": [],
"aliases": [
"CVE-2021-46660"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-30T00:15:00Z",
"severity": "CRITICAL"
},
"details": "Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.",
"id": "GHSA-p2hq-x27f-8mx5",
"modified": "2022-02-05T00:00:58Z",
"published": "2022-01-31T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46660"
},
{
"type": "WEB",
"url": "https://help.signiant.com/flight-deck/general/release-notes-15-1"
},
{
"type": "WEB",
"url": "https://www.signiant.com/technology/security"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-P2JV-394X-276F
Vulnerability from github – Published: 2022-05-17 00:33 – Updated: 2022-05-17 00:33OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.
{
"affected": [],
"aliases": [
"CVE-2017-14759"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-03T01:29:00Z",
"severity": "CRITICAL"
},
"details": "OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service.",
"id": "GHSA-p2jv-394x-276f",
"modified": "2022-05-17T00:33:46Z",
"published": "2022-05-17T00:33:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14759"
},
{
"type": "WEB",
"url": "https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Sep/97"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P2Q7-R6VQ-359J
Vulnerability from github – Published: 2026-08-10 18:32 – Updated: 2026-08-10 18:32Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.
This issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.
{
"affected": [],
"aliases": [
"CVE-2026-16626"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T18:17:41Z",
"severity": "CRITICAL"
},
"details": "Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.\n\nThis issue affects JasperReports Server: from 9.0.0 before HF-9 and from 10.0.0 before HF-10.",
"id": "GHSA-p2q7-r6vq-359j",
"modified": "2026-08-10T18:32:17Z",
"published": "2026-08-10T18:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16626"
},
{
"type": "WEB",
"url": "https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-august-05-2026-jasperreports-server-cve-2026-16626-r12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P2QF-9VP6-3JJQ
Vulnerability from github – Published: 2023-06-15 15:30 – Updated: 2024-03-01 14:32A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "cn.hutool:hutool-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.8.19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3276"
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-16T19:39:29Z",
"nvd_published_at": "2023-06-15T13:15:09Z",
"severity": "HIGH"
},
"details": "A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference.",
"id": "GHSA-p2qf-9vp6-3jjq",
"modified": "2024-03-01T14:32:41Z",
"published": "2023-06-15T15:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3276"
},
{
"type": "WEB",
"url": "https://fbdhhhh47.github.io/2023/06/06/hutool-XXE"
},
{
"type": "PACKAGE",
"url": "https://github.com/dromara/hutool"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.231626"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.231626"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "HuTool XML parsing module has blind XXE vulnerability"
}
Mitigation
Many XML parsers and validators can be configured to disable external entity expansion.
CAPEC-221: Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.