CWE-611 · Injection and Smuggling
XML External Entity
1,363CVEs
9exploited
27with a public check
73likely (EPSS 10%+)
SortMost likely exploited
1,363 CVEs with CWE-611 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-34102In CISA KEVExploitedAdobe Commerce & Magento - CosmicStingAdobe · Adobe Commerce · CVSS 9.8 · 2024-06-13 | 9.8 | 100% | 2024-06-13 |
| CVE-2019-9670In CISA KEVExploitedSynacor Zimbra Collaboration <8.7.11p10 - XML External Entity InjectionSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 9.8 · 2019-05-29 | 9.8 | 100% | 2019-05-29 |
| CVE-2025-2776In CISA KEVExploitedSysAid On-Prem <= 23.3.40 - XML External EntitySysAid · SysAid On-Prem · CVSS 9.3 · 2025-05-07 | 9.3 | 65% | 2025-05-07 |
| CVE-2025-58360In CISA KEVExploitedGeoServer - XML External Entity Injectiongeoserver · geoserver · CVSS 8.2 · 2025-11-25 | 8.2 | 61% | 2025-11-25 |
| CVE-2025-2775In CISA KEVExploitedSysAid On-Prem <= 23.3.40 - XML External EntitySysAid · SysAid On-Prem · CVSS 9.3 · 2025-05-07 | 9.3 | 43% | 2025-05-07 |
| CVE-2019-13608In CISA KEVExploitedCitrix StoreFront Server - XML External EntityCitrix · StoreFront Server · CVSS 7.5 · 2019-08-29 | 7.5 | 30% | 2019-08-29 |
| CVE-2016-9563In CISA KEVExploitedBC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwl…SAP · NetWeaver · CVSS 6.5 · 2016-11-23 | 6.5 | 24% | 2016-11-23 |
| CVE-2023-45727In CISA KEVExploitedProself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthen…North Grid Corporation · Proself Enterprise/Standard Edition · CVSS 7.5 · 2023-10-18 | 7.5 | 4.8% | 2023-10-18 |
| CVE-2026-20320In CISA KEVExploitedA vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticated, remote attacker to read sensitive configuration information on an…Cisco · Cisco BroadWorks · CVSS 7.5 · 2026-08-19 | 7.5 | 1.0% | 2026-08-19 |
| CVE-2022-28219CheckZoho ManageEngine ADAudit Plus <7600 - XML Entity Injection/Remote Code ExecutionZohocorp · Manageengine Adaudit Plus · 2022-04-05 | – | 97% | 2022-04-05 |
| CVE-2024-22024CheckIvanti Connect Secure - XXEIvanti · ICS · CVSS 8.3 · 2024-02-13 | 8.3 | 95% | 2024-02-13 |
| CVE-2017-12629CheckApache Solr <= 7.1 - XML Entity InjectionApache · Apache Solr before 7.1 with Apache Lucene before 7.1 · 2017-10-14 | – | 92% | 2017-10-14 |
| CVE-2024-38653CheckIvanti Avalanche SmartDeviceServer - XML External EntityIvanti · Avalanche · CVSS 8.2 · 2024-08-14 | 8.2 | 92% | 2024-08-14 |
| CVE-2025-66516CheckApache Tika - XML External Entity InjectionApache Software Foundation · Apache Tika core · CVSS 8.4 · 2025-12-04 | 8.4 | 89% | 2025-12-04 |
| CVE-2022-2414CheckFreeIPA - XML Entity InjectionDogtagpki · Dogtag PKI · 2022-07-29 | – | 85% | 2022-07-29 |
| CVE-2025-2777CheckSysAid On-Prem <= 23.3.40 - XML External EntitySysAid · SysAid On-Prem · CVSS 9.3 · 2025-05-07 | 9.3 | 73% | 2025-05-07 |
| CVE-2020-11991CheckApache Cocoon 2.1.12 - XML InjectionApache · Apache Cocoon · 2020-09-11 | – | 73% | 2020-09-11 |
| CVE-2025-68493CheckApache Struts XWork - XML External Entity InjectionApache Software Foundation · Apache Struts · CVSS 8.1 · 2026-01-11 | 8.1 | 50% | 2026-01-11 |
| CVE-2025-30220CheckGeoServer WFS - XXE Processing Vulnerabilitygeoserver · geoserver · CVSS 9.9 · 2025-06-10 | 9.9 | 44% | 2025-06-10 |
| CVE-2018-2392CheckSAP Internet Graphics Server (IGS) - XML External Entity InjectionSAP SE · SAP Internet Graphics Server · 2018-02-14 | – | 41% | 2018-02-14 |
| CVE-2019-9757CheckLabKey Server 19.1.0 - XML External Entity (XXE)Labkey · Labkey Server · 2019-10-29 | – | 37% | 2019-10-29 |
| CVE-2025-54988CheckApache Tika - XXE InjectionApache Software Foundation · Apache Tika PDF parser module · CVSS 8.4 · 2025-08-20 | 8.4 | 36% | 2025-08-20 |
| CVE-2024-6893CheckJournyx - XML External Entities Injection (XXE)Journyx · Journyx (jtime) · CVSS 7.5 · 2024-08-07 | 7.5 | 33% | 2024-08-07 |
| CVE-2025-11700CheckN-central - XML External Entities InjectionN-able · N-central · CVSS 8.4 · 2025-11-12 | 8.4 | 32% | 2025-11-12 |
| CVE-2020-4463CheckIBM Maximo Asset Management Information Disclosure - XML External Entity InjectionIBM · Maximo Asset Management · CVSS 8.2 · 2020-07-29 | 8.2 | 32% | 2020-07-29 |
| CVE-2020-24589CheckWSO2 API Manager <=3.1.0 - Blind XML External Entity InjectionWso2 · Api Manager · CVSS 9.1 · 2020-08-21 | 9.1 | 26% | 2020-08-21 |
| CVE-2019-8086CheckAdobe Experience Manager - XML External Entity InjectionAdobe · Adobe Experience Manager · 2019-10-25 | – | 23% | 2019-10-25 |
| CVE-2021-27931CheckLumisXP <10.0.0 - Blind XML External Entity AttackLumis · Lumis Experience Platform · 2021-03-03 | – | 18% | 2021-03-03 |
| CVE-2011-3600CheckApache OFBiz - XML External Entity InjectionOFBiz · OFBiz · 2019-11-26 | – | 16% | 2019-11-26 |
| CVE-2022-3980CheckSophos Mobile managed on-premises - XML External Entity InjectionSophos · Sophos Mobile managed on-premises · CVSS 9.8 · 2022-11-16 | 9.8 | 13% | 2022-11-16 |
| CVE-2022-38840CheckGüralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE)Guralp · Man-Eam-0003 · CVSS 7.5 · 2023-04-16 | 7.5 | 9.8% | 2023-04-16 |
| CVE-2022-31678CheckVMWare Cloud Foundation NSX-V - XML External Entity (XXE)Vmware · VMware Cloud Foundation (NSX-V) · CVSS 9.1 · 2022-10-28 | 9.1 | 9.4% | 2022-10-28 |
| CVE-2017-17762CheckEpiserver 7 - Blind XML External Entity InjectionEpiserver · Episerver · 2018-08-29 | – | 4.6% | 2018-08-29 |
| CVE-2024-45293CheckTablePress < 2.4.3 - XXE InjectionPHPOffice · PhpSpreadsheet · CVSS 7.5 · 2024-10-07 | 7.5 | 2.8% | 2024-10-07 |
| CVE-2023-42344CheckOpenCMS - XML external entity (XXE)No vendor recorded · CVSS 7.3 · 2026-05-08 | 7.3 | 2.3% | 2026-05-08 |
| CVE-2025-49493CheckAkamai CloudTest < 60 2025.06.02 - XML External Entity (XXE)Akamai · CloudTest · CVSS 5.8 · 2025-06-30 | 5.8 | 2.1% | 2025-06-30 |
| CVE-2021-29447WordPress Authenticated XXE attack when installation is running PHP 8WordPress · wordpress-develop · CVSS 7.1 · 2021-04-15 | 7.1 | 86% | 2021-04-15 |
| CVE-2021-2401Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 1…Oracle Corporation · BI Publisher (formerly XML Publisher) · CVSS 5.3 · 2021-07-20 | 5.3 | 85% | 2021-07-20 |
| CVE-2023-44412D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure VulnerabilityD-Link · D-View · CVSS 8.2 · 2024-05-03 | 8.2 | 82% | 2024-05-03 |
| CVE-2020-27858This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required to exploit this vuln…Arcserve · D2D · CVSS 7.5 · 2021-01-20 | 7.5 | 74% | 2021-01-20 |
| CVE-2020-17408This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vu…NEC · ExpressCluster · CVSS 7.5 · 2020-09-10 | 7.5 | 71% | 2020-09-10 |
| CVE-2016-4264The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intrane…Adobe · Coldfusion · 2016-09-01 | – | 69% | 2016-09-01 |
| CVE-2021-37425Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then…Altova · Mobiletogether Server · 2021-08-10 | – | 66% | 2021-08-10 |
| CVE-2020-15419This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit…Veeam · ONE · CVSS 7.5 · 2020-07-28 | 7.5 | 60% | 2020-07-28 |
| CVE-2024-37397An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to…Ivanti · EPM · CVSS 8.2 · 2024-09-12 | 8.2 | 59% | 2024-09-12 |
| CVE-2024-30043Microsoft SharePoint Server Information Disclosure VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 6.5 · 2024-05-14 | 6.5 | 56% | 2024-05-14 |
| CVE-2025-54254Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)Adobe · Adobe Experience Manager · CVSS 8.6 · 2025-08-05 | 8.6 | 54% | 2025-08-05 |
| CVE-2022-38419Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system readAdobe · ColdFusion · CVSS 7.5 · 2022-10-14 | 7.5 | 54% | 2022-10-14 |
| CVE-2017-3548Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 an…Oracle Corporation · PeopleSoft Enterprise PT PeopleTools · 2017-04-24 | – | 52% | 2017-04-24 |
| CVE-2012-3363Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files…Zend · Zend Framework · CVSS 9.1 · 2013-02-13 | 9.1 | 49% | 2013-02-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.