CWE-611

Improper Restriction of XML External Entity Reference

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

1,250 vulnerabilities with CWE-611
CVE-2025-52162 MEDIUM
Agorum core open 11.9.2 & 11.10.1 - XML External Entity Injection via RSSReader Endpoint
CVSS 6.5
CVE-2025-53621 MEDIUM
DSpace < 7.6.4, 8.0-8.2, 9.0-9.1 - XML External Entity Injection in Archive Import and External Service Responses
CVSS 6.9
CVE-2025-53689 HIGH
Apache Jackrabbit <2.23.2 - Blind XXE
CVSS 8.8
CVE-2025-7523 HIGH
Jinher OA 1.0 - XML External Entity Reference
CVSS 7.3
CVE-2025-6438 MEDIUM
SOAP API - XML External Entity Injection
CVE-2025-49544 MEDIUM
ColdFusion <= 2025.2, 2023.14, 2021.20 - Authenticated XML External Entity Injection
CVSS 6.8
CVE-2025-49539 MEDIUM
ColdFusion <= 2025.2, 2023.14, 2021.20 - XML External Entity Injection
CVSS 4.5
CVE-2025-49535 CRITICAL
ColdFusion 2025.2 2023.14 2021.20 - XML External Entity Injection
CVSS 9.3
CVE-2025-49493 MEDIUM
Akamai CloudTest <60 - XXE Injection
CVSS 5.8
CVE-2025-52888 HIGH
Allure 2 xunit-xml-plugin < 2.34.1 - XML External Entity Injection via Unsafe DocumentBuilderFactory Configuration
CVSS 7.5
CVE-2025-47293 LOW
PowSyBl < 6.7.2 - XML External Entity Injection and Server-Side Request Forgery via XmlReader
CVE-2025-33121 HIGH
IBM QRadar SIEM 7.5 to 7.5.0-12 - XML External Entity Injection
CVSS 7.1
CVE-2025-36049 HIGH
IBM webMethods Integration Server 10.5, 10.7, 10.11, 10.15 - Authenticated XML External Entity Injection
CVSS 8.8
CVE-2025-44044 HIGH
Keyoti SearchUnit < 9.0.0 - XML External Entity Injection
CVSS 7.5
CVE-2025-30220 CRITICAL
GeoServer WFS - XXE Processing Vulnerability
CVSS 9.9
CVE-2025-31039 CRITICAL
pixelgrade Category Icon <1.0.2 - SSRF
CVSS 9.1
CVE-2025-5877 MEDIUM
Feng Office 3.2.2.1 - XML External Entity Injection in Document Upload Handler
CVSS 6.3
CVE-2025-48882 HIGH
PHPOffice Math < 0.3.0 - XML External Entity Injection via libxml DTDLOAD Flag
CVE-2025-4338 MEDIUM
Lantronix Device Installer < 4.4.0.7 - XML External Entity Injection in Configuration Files
CVSS 6.8
CVE-2025-4949 MEDIUM
Eclipse JGit < 5.13.4 and 7.2.0.202503040940-r-7.2.1.202505142326-r - XXE in ManifestParser and AmazonS3
CVSS 5.3
CVE-2025-27523 HIGH
Hitachi JP1/IT Desktop Management 2 - Smart Device Manager <12-00-0...
CVSS 8.7
CVE-2025-4641 CRITICAL
bonigarcia webdrivermanager <6.0.2 - SSRF
CVE-2025-4639 HIGH
Peergos <1.1.0 - XML External Entity Reference
CVE-2025-47778 MEDIUM
Sulu 2.5.21-2.5.24, 2.6.5-2.6.8, 3.0.0-alpha1-3.0.0-alpha2 - XML External Entity Injection via SVG Upload
CVE-2025-30018 HIGH
SAP Supplier Relationship Management - Unauthenticated XML External Entity Injection via Live Auction Cockpit
CVSS 8.6
Details
Vulnerabilities 1,250