CWE-91 · Injection and Smuggling
XML Injection
146CVEs
1exploited
3with a public check
5likely (EPSS 10%+)
SortMost likely exploited
146 CVEs with CWE-91 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-0646In CISA KEVExploitedA remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.Microsoft · Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 · CVSS 9.8 · 2020-01-14 | 9.8 | 99% | 2020-01-14 |
| CVE-2023-43187CheckNodeBB XML-RPC Request xmlrpc.php - XML InjectionNodebb · Nodebb · 2023-09-26 | – | 47% | 2023-09-26 |
| CVE-2022-25356CheckAlt-n/MDaemon Security Gateway <=8.5.0 - XML InjectionAltn · Securitygateway · CVSS 5.3 · 2022-04-05 | 5.3 | 5.7% | 2022-04-05 |
| CVE-2025-54251CheckAdobe Experience Manager ≤ 6.5.23.0 - XML InjectionAdobe · Adobe Experience Manager · CVSS 4.3 · 2025-09-09 | 4.3 | 1.7% | 2025-09-09 |
| CVE-2023-27253A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the con…Netgate · Pfsense · 2023-03-17 | – | 90% | 2023-03-17 |
| CVE-2023-46214Remote code execution (RCE) in Splunk Enterprise through Insecure XML ParsingSplunk · Splunk Enterprise · CVSS 8 · 2023-11-16 | 8.0 | 89% | 2023-11-16 |
| CVE-2024-53675An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.Hewlett Packard Enterprise (HPE) · HPE Insight Remote Support · CVSS 7.3 · 2024-11-26 | 7.3 | 81% | 2024-11-26 |
| CVE-2024-53674An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.Hewlett Packard Enterprise (HPE) · HPE Insight Remote Support · CVSS 7.3 · 2024-11-26 | 7.3 | 47% | 2024-11-26 |
| CVE-2016-6272XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic…Epic · Mychart · 2018-02-20 | – | 21% | 2018-02-20 |
| CVE-2019-17626ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitr…Reportlab · Reportlab · CVSS 9.8 · 2019-10-16 | 9.8 | 9.5% | 2019-10-16 |
| CVE-2018-19277securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx filePhpoffice · Phpspreadsheet · 2018-11-14 | – | 7.8% | 2018-11-14 |
| CVE-2020-29599ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled pa…Imagemagick · Imagemagick · 2020-12-07 | – | 7.5% | 2020-12-07 |
| CVE-2019-14277Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword funct…Axway · Securetransport · 2019-07-26 | – | 7.3% | 2019-07-26 |
| CVE-2018-1000632dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering w…Dom4j Project · Dom4j · 2018-08-20 | – | 6.6% | 2018-08-20 |
| CVE-2019-19450paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML docu…Reportlab · Reportlab · 2023-09-20 | – | 6.0% | 2023-09-20 |
| CVE-2015-6970The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the id…Boschsecurity · Nbn-498 Dinion2x Day/night Ip Cameras Firmware · 2020-02-18 | – | 5.3% | 2020-02-18 |
| CVE-2022-34253Adobe Commerce XML Injection Arbitrary code executionAdobe · Magento Commerce · CVSS 9.1 · 2022-08-16 | 9.1 | 5.2% | 2022-08-16 |
| CVE-2019-16941NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML doc…Nsa · Ghidra · 2019-09-28 | – | 5.1% | 2019-09-28 |
| CVE-2019-25137Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:script in an xsltSelection to developer/Xslt/xsltVisualize.a…Umbraco · Umbraco Cms · CVSS 7.2 · 2023-05-18 | 7.2 | 4.1% | 2023-05-18 |
| CVE-2022-22784Improper XML Parsing in Zoom Client for MeetingsZoom Video Communications Inc · Zoom Client for Meetings for Android · CVSS 8.1 · 2022-05-18 | 8.1 | 4.1% | 2022-05-18 |
| CVE-2014-1409MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwordsMobileiron · Sentry · 2020-01-08 | – | 4.0% | 2020-01-08 |
| CVE-2021-36359OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi…Bscw · Bscw Classic · 2021-08-30 | – | 4.0% | 2021-08-30 |
| CVE-2008-5024Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XM…Mozilla · Firefox · 2008-11-13 | – | 3.6% | 2008-11-13 |
| CVE-2021-21019Magento Commerce XML Injection Could Lead To Remote Code ExecutionAdobe · Magento Commerce · CVSS 9.1 · 2021-02-11 | 9.1 | 3.6% | 2021-02-11 |
| CVE-2022-22834An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. A…Overit · Geocall · 2022-03-07 | – | 3.5% | 2022-03-07 |
| CVE-2013-4221The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote atta…Restlet · Restlet · 2013-10-10 | – | 3.4% | 2013-10-10 |
| CVE-2021-21025Magento Commerce XML Injection Could Lead To Arbitrary Code ExecutionAdobe · Magento Commerce · CVSS 9.1 · 2021-02-11 | 9.1 | 3.2% | 2021-02-11 |
| CVE-2021-36033Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code ExecutionAdobe · Magento Commerce · CVSS 9.1 · 2021-09-01 | 9.1 | 2.9% | 2021-09-01 |
| CVE-2021-36028Magento Commerce XML Injection Vulnerability Could Lead To Remote Code ExecutionAdobe · Magento Commerce · CVSS 9.1 · 2021-09-01 | 9.1 | 2.7% | 2021-09-01 |
| CVE-2021-36020Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code ExecutionAdobe · Magento Commerce · CVSS 8.2 · 2021-09-01 | 8.2 | 2.6% | 2021-09-01 |
| CVE-2020-25216yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet.Yworks · Yed · 2020-09-17 | – | 2.4% | 2020-09-17 |
| CVE-2025-49538ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)Adobe · ColdFusion · CVSS 7.4 · 2025-07-08 | 7.4 | 2.4% | 2025-07-08 |
| CVE-2018-16784DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.Dedecms · Dedecms · 2018-09-21 | – | 2.3% | 2018-09-21 |
| CVE-2020-29128petl before 1.68, in some configurations, allows resolution of entities in an XML document.Petl Project · Petl · 2020-11-26 | – | 2.3% | 2020-11-26 |
| CVE-2020-11535An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into…Onlyoffice · Document Server · 2020-04-15 | – | 2.3% | 2020-04-15 |
| CVE-2020-8479ABB Central Licensing System - XML External Entity InjectionABB · Central Licensing System · CVSS 9.4 · 2020-04-29 | 9.4 | 2.3% | 2020-04-29 |
| CVE-2013-7429The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.Mapsplugin · Googlemaps · 2017-09-14 | – | 2.2% | 2017-09-14 |
| CVE-2019-0268SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.SAP SE · SAP BusinessObjects Business Intelligence Platform (CMC Module) · 2019-03-12 | – | 2.2% | 2019-03-12 |
| CVE-2017-5654In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari serv…Apache Software Foundation · Apache Ambari · 2017-05-12 | – | 2.2% | 2017-05-12 |
| CVE-2015-3931Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prep…Microsec · E-Szigno · 2017-07-21 | – | 2.1% | 2017-07-21 |
| CVE-2015-3932Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepen…Netlock · Mokka · 2017-07-21 | – | 2.1% | 2017-07-21 |
| CVE-2026-76979XML Injection vulnerabilityZohocorp · ManageEngine OpManager · CVSS 7.7 · 2026-09-23 | 7.7 | 2.1% | 2026-09-23 |
| CVE-2021-38948IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability…IBM · InfoSphere Information Server · CVSS 7.1 · 2021-11-02 | 7.1 | 2.0% | 2021-11-02 |
| CVE-2018-1000526Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted X…Openpsa2 · Openpsa · 2018-06-26 | – | 2.0% | 2018-06-26 |
| CVE-2021-32758Layout XML Arbitrary Code FixOpenMage · magento-lts · CVSS 7.2 · 2021-08-27 | 7.2 | 2.0% | 2021-08-27 |
| CVE-2018-16785XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshellDedecms · Dedecms · 2018-09-19 | – | 1.9% | 2018-09-19 |
| CVE-2021-39181Unsafe Deserialization of User Data Using XStreamOpenOLAT · OpenOLAT · CVSS 8.8 · 2021-09-01 | 8.8 | 1.9% | 2021-09-01 |
| CVE-2018-1721IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to ex…IBM · Cognos Analytics · CVSS 8.3 · 2019-11-09 | 8.3 | 1.8% | 2019-11-09 |
| CVE-2018-2477Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source.SAP · Knowledge Management (XMLForms) in SAP NetWeaver · 2018-11-13 | – | 1.7% | 2018-11-13 |
| CVE-2017-15685Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retriev…Craftercms · Crafter Cms · 2020-11-27 | – | 1.7% | 2020-11-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.