Skip to content
BackEsc
Sign in

CWE-91 · weakness in Injection and Smuggling

XML Injection

146 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
3
likely to be exploited
5

Every one of the 146 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.CVE-2020-0646Microsoft · CVSS 9.8 · 99% likely

    Microsoft

  2. NodeBB XML-RPC Request xmlrpc.php - XML InjectionCVE-2023-4318747% likely
  3. Alt-n/MDaemon Security Gateway <=8.5.0 - XML InjectionCVE-2022-25356CVSS 5.3 · 5.7% likely
  4. Adobe Experience Manager ≤ 6.5.23.0 - XML InjectionCVE-2025-54251Adobe · CVSS 4.3 · 1.7% likely

    Adobe

  5. A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the con…CVE-2023-2725390% likely
  6. Remote code execution (RCE) in Splunk Enterprise through Insecure XML ParsingCVE-2023-46214Splunk · CVSS 8 · 89% likely

    Splunk

  7. An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.CVE-2024-53675Hewlett Packard Enterprise (HPE) · CVSS 7.3 · 81% likely

    Hewlett Packard Enterprise

  8. An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.CVE-2024-53674Hewlett Packard Enterprise (HPE) · CVSS 7.3 · 47% likely

    Hewlett Packard Enterprise

  9. XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic…CVE-2016-627221% likely
  10. ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitr…CVE-2019-17626CVSS 9.8 · 9.5% likely
  11. securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx fileCVE-2018-192777.8% likely
  12. ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled pa…CVE-2020-295997.5% likely
  13. Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword funct…CVE-2019-142777.3% likely
  14. dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering w…CVE-2018-10006326.6% likely
  15. paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML docu…CVE-2019-194506.0% likely
  16. The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the id…CVE-2015-69705.3% likely
  17. Adobe Commerce XML Injection Arbitrary code executionCVE-2022-34253Adobe · CVSS 9.1 · 5.2% likely

    Adobe

  18. NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML doc…CVE-2019-169415.1% likely
  19. Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.a…CVE-2019-25137CVSS 7.2 · 4.1% likely
  20. Improper XML Parsing in Zoom Client for MeetingsCVE-2022-22784Zoom Video Communications Inc · CVSS 8.1 · 4.1% likely

    Zoom Video Communications, Inc.

  21. MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwordsCVE-2014-14094.0% likely
  22. OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi…CVE-2021-363594.0% likely
  23. Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XM…CVE-2008-50243.6% likely
  24. Magento Commerce XML Injection Could Lead To Remote Code ExecutionCVE-2021-21019Adobe · CVSS 9.1 · 3.6% likely

    Adobe

  25. An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. A…CVE-2022-228343.5% likely
  26. The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote atta…CVE-2013-42213.4% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in