CVE Daily – XML Injection (High+Critical) https://cvedaily.com/pages/tags/xml-injection.html CVE Daily – XML Injection (High+Critical) en Wed, 03 Jun 2026 21:26:51 +0000 [High] CVE-2026-28770 – Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi ... https://nvd.nist.gov/vuln/detail/CVE-2026-28770 https://nvd.nist.gov/vuln/detail/CVE-2026-28770 Wed, 04 Mar 2026 07:16:14 +0000 High CVE-2026-28770

Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tag…

CVSS: 8.8 · CWE: CWE-91

View on NVD

]]> [High] CVE-2025-24404 – XML Injection RCE by parse http sitemap xml response vulnerability in Apache Her... https://nvd.nist.gov/vuln/detail/CVE-2025-24404 https://nvd.nist.gov/vuln/detail/CVE-2025-24404 Tue, 09 Sep 2025 10:15:33 +0000 High CVE-2025-24404

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the is…

CVSS: 8.8 · CWE: CWE-91

View on NVD

]]> [High] CVE-2025-49538 – ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML ... https://nvd.nist.gov/vuln/detail/CVE-2025-49538 https://nvd.nist.gov/vuln/detail/CVE-2025-49538 Tue, 08 Jul 2025 21:15:26 +0000 High CVE-2025-49538

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.

CVSS: 7.4 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2024-7098 – Improper Restriction of XML External Entity Reference vulnerability in SFS Consu... https://nvd.nist.gov/vuln/detail/CVE-2024-7098 https://nvd.nist.gov/vuln/detail/CVE-2024-7098 Mon, 16 Sep 2024 15:15:17 +0000 Critical CVE-2024-7098

Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4.6.2.

CVSS: 9.8 · CWE: CWE-611

View on NVD

]]> [High] CVE-2024-34740 – In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there... https://nvd.nist.gov/vuln/detail/CVE-2024-34740 https://nvd.nist.gov/vuln/detail/CVE-2024-34740 Thu, 15 Aug 2024 22:15:06 +0000 High CVE-2024-34740

In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS: 7.8 · CWE: CWE-190

View on NVD

]]> [High] CVE-2023-27328 – Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerabilit... https://nvd.nist.gov/vuln/detail/CVE-2023-27328 https://nvd.nist.gov/vuln/detail/CVE-2023-27328 Fri, 03 May 2024 02:15:09 +0000 High CVE-2023-27328

Parallels Desktop Toolgate XML Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The is…

CVSS: 7.8 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2021-36023 – Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 ... https://nvd.nist.gov/vuln/detail/CVE-2021-36023 https://nvd.nist.gov/vuln/detail/CVE-2021-36023 Wed, 06 Sep 2023 14:15:08 +0000 Critical CVE-2021-36023

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

CVSS: 9.1 · CWE: CWE-78

View on NVD

]]> [High] CVE-2022-46751 – Improper Restriction of XML External Entity Reference, XML Injection (aka Blind ... https://nvd.nist.gov/vuln/detail/CVE-2022-46751 https://nvd.nist.gov/vuln/detail/CVE-2022-46751 Mon, 21 Aug 2023 07:15:33 +0000 High CVE-2022-46751

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand…

CVSS: 8.2 · CWE: CWE-91

View on NVD

]]> [High] CVE-2023-38207 – Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4... https://nvd.nist.gov/vuln/detail/CVE-2023-38207 https://nvd.nist.gov/vuln/detail/CVE-2023-38207 Wed, 09 Aug 2023 08:15:09 +0000 High CVE-2023-38207

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.

CVSS: 7.5 · CWE: CWE-91

View on NVD

]]> [High] CVE-2023-22247 – Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are af... https://nvd.nist.gov/vuln/detail/CVE-2023-22247 https://nvd.nist.gov/vuln/detail/CVE-2023-22247 Mon, 27 Mar 2023 21:15:10 +0000 High CVE-2023-22247

Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An unauthenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction.

CVSS: 7.5 · CWE: CWE-91

View on NVD

]]> [High] CVE-2022-35259 – XML Injection with Endpoint Manager 2022. 3 and below causing a download of a ma... https://nvd.nist.gov/vuln/detail/CVE-2022-35259 https://nvd.nist.gov/vuln/detail/CVE-2022-35259 Mon, 05 Dec 2022 22:15:10 +0000 High CVE-2022-35259

XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges.

CVSS: 7.8 · CWE: CWE-91

View on NVD

]]> [High] CVE-2022-34253 – Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4... https://nvd.nist.gov/vuln/detail/CVE-2022-34253 https://nvd.nist.gov/vuln/detail/CVE-2022-34253 Tue, 16 Aug 2022 21:15:09 +0000 High CVE-2022-34253

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. Exploitation of this issue does not require user interaction.

CVSS: 7.2 · CWE: CWE-91

View on NVD

]]> [High] CVE-2022-32458 – Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insuf... https://nvd.nist.gov/vuln/detail/CVE-2022-32458 https://nvd.nist.gov/vuln/detail/CVE-2022-32458 Wed, 20 Jul 2022 02:15:07 +0000 High CVE-2022-32458

Digiwin BPM has a XML External Entity Injection (XXE) vulnerability due to insufficient validation for user input. An unauthenticated remote attacker can perform XML injection attack to access arbitrary system files.

CVSS: 7.5 · CWE: CWE-611

View on NVD

]]> [Critical] CVE-2021-36033 – Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 ... https://nvd.nist.gov/vuln/detail/CVE-2021-36033 https://nvd.nist.gov/vuln/detail/CVE-2021-36033 Wed, 01 Sep 2021 15:15:09 +0000 Critical CVE-2021-36033

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

CVSS: 9.1 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2021-36028 – Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 ... https://nvd.nist.gov/vuln/detail/CVE-2021-36028 https://nvd.nist.gov/vuln/detail/CVE-2021-36028 Wed, 01 Sep 2021 15:15:09 +0000 Critical CVE-2021-36028

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

CVSS: 9.1 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2021-36022 – Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 ... https://nvd.nist.gov/vuln/detail/CVE-2021-36022 https://nvd.nist.gov/vuln/detail/CVE-2021-36022 Wed, 01 Sep 2021 15:15:09 +0000 Critical CVE-2021-36022

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

CVSS: 9.1 · CWE: CWE-78

View on NVD

]]> [High] CVE-2021-36020 – Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 ... https://nvd.nist.gov/vuln/detail/CVE-2021-36020 https://nvd.nist.gov/vuln/detail/CVE-2021-36020 Wed, 01 Sep 2021 15:15:09 +0000 High CVE-2021-36020

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

CVSS: 8.2 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2021-37154 – In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allow... https://nvd.nist.gov/vuln/detail/CVE-2021-37154 https://nvd.nist.gov/vuln/detail/CVE-2021-37154 Wed, 25 Aug 2021 21:15:08 +0000 Critical CVE-2021-37154

In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

CVSS: 9.8 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2021-21025 – Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earl... https://nvd.nist.gov/vuln/detail/CVE-2021-21025 https://nvd.nist.gov/vuln/detail/CVE-2021-21025 Thu, 11 Feb 2021 20:15:14 +0000 Critical CVE-2021-21025

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

CVSS: 9.1 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2021-21019 – Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earl... https://nvd.nist.gov/vuln/detail/CVE-2021-21019 https://nvd.nist.gov/vuln/detail/CVE-2021-21019 Thu, 11 Feb 2021 20:15:14 +0000 Critical CVE-2021-21019

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

CVSS: 9.1 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2020-11535 – An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can cra... https://nvd.nist.gov/vuln/detail/CVE-2020-11535 https://nvd.nist.gov/vuln/detail/CVE-2020-11535 Wed, 15 Apr 2020 15:15:19 +0000 Critical CVE-2020-11535

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, and execute code on a victim's server.

CVSS: 9.8 · CWE: CWE-91

View on NVD

]]> [Critical] CVE-2015-6970 – The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Camera... https://nvd.nist.gov/vuln/detail/CVE-2015-6970 https://nvd.nist.gov/vuln/detail/CVE-2015-6970 Tue, 18 Feb 2020 14:15:12 +0000 Critical CVE-2015-6970

The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.

CVSS: 9.8 · CWE: CWE-91

View on NVD

]]> [High] CVE-2019-16174 – An XML injection vulnerability was found in Limesurvey before 3.17.14 that allow... https://nvd.nist.gov/vuln/detail/CVE-2019-16174 https://nvd.nist.gov/vuln/detail/CVE-2019-16174 Mon, 09 Sep 2019 21:15:11 +0000 High CVE-2019-16174

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity.

CVSS: 8.8 · CWE: CWE-611

View on NVD

]]> [Critical] CVE-2019-14277 – Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API confi... https://nvd.nist.gov/vuln/detail/CVE-2019-14277 https://nvd.nist.gov/vuln/detail/CVE-2019-14277 Fri, 26 Jul 2019 04:15:11 +0000 Critical CVE-2019-14277

Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to local file disclosure, DoS, or URI invocation attacks (i.e., SSRF with resultant remote code execution). NOTE: The vendor disputes this issues as not being a vuln…

CVSS: 9.8 · CWE: CWE-91

View on NVD

]]> [High] CVE-2019-1010017 – libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service... https://nvd.nist.gov/vuln/detail/CVE-2019-1010017 https://nvd.nist.gov/vuln/detail/CVE-2019-1010017 Mon, 15 Jul 2019 03:15:10 +0000 High CVE-2019-1010017

libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.

CVSS: 7.5 · CWE: CWE-91

View on NVD

]]> [High] CVE-2019-12787 – An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BET... https://nvd.nist.gov/vuln/detail/CVE-2019-12787 https://nvd.nist.gov/vuln/detail/CVE-2019-12787 Mon, 10 Jun 2019 18:29:00 +0000 High CVE-2019-12787

An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key.

CVSS: 8.8 · CWE: CWE-78

View on NVD

]]> [High] CVE-2019-12786 – An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BET... https://nvd.nist.gov/vuln/detail/CVE-2019-12786 https://nvd.nist.gov/vuln/detail/CVE-2019-12786 Mon, 10 Jun 2019 18:29:00 +0000 High CVE-2019-12786

An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the IPAddress key.

CVSS: 8.8 · CWE: CWE-77

View on NVD

]]> [High] CVE-2017-9362 – ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Confi... https://nvd.nist.gov/vuln/detail/CVE-2017-9362 https://nvd.nist.gov/vuln/detail/CVE-2017-9362 Mon, 25 Mar 2019 16:29:03 +0000 High CVE-2017-9362

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

CVSS: 8.8 · CWE: CWE-611

View on NVD

]]> [High] CVE-2018-16784 – DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a... https://nvd.nist.gov/vuln/detail/CVE-2018-16784 https://nvd.nist.gov/vuln/detail/CVE-2018-16784 Fri, 21 Sep 2018 15:29:00 +0000 High CVE-2018-16784

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "