CVE-2024-7098

CRITICAL

SFS ww.Winsure < 4.6.2 - XML External Entity Injection

Title source: llm

Description

Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4.6.2.

References (2)

Core 2

Core References

Broken Link, Third Party Advisory government-resource broken-link

https://www.usom.gov.tr/bildirim/tr-24-1475

Government Resource government-resource

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1475

Scores

CVSS v3 9.8

EPSS 0.0047

EPSS Percentile 36.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-611

Status published

Products (2)

sfs/winsure < 4.6.2

SFS Consulting/ww.Winsure < 4.6.2

Published Sep 16, 2024

Tracked Since Feb 18, 2026