Skip to content
Noroxi

CWE-776 · 87 records

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

CVEs in this class

87 records

  • CVE-2009-1955
    46Plan

    The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn mod

    HighCVSS 7.5Proof of conceptEPSS 52%

    apache · apr-utilJun 7, 2009

  • CVE-2014-2228
    40Plan

    The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML m

    CriticalCVSS 9.8No exploitEPSS 3%

    talend · restletFeb 19, 2020

  • CVE-2013-4335
    40Plan

    opOpenSocialPlugin 0.8.2.1, > 0.9.9.2, 0.9.13, 1.2.6: Multiple XML External Entity Injection Vulnerabilities

    CriticalCVSS 9.8No exploitEPSS 2%

    openpne · opopensocialpluginFeb 7, 2020

  • CVE-2019-19144
    39Monitor

    XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.

    CriticalCVSS 9.8No exploitEPSS 0%

    Aug 1, 2025

  • CVE-2017-18640
    38Monitor

    The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

    HighCVSS 7.5No exploitEPSS 26%

    snakeyaml project · snakeyamlDec 11, 2019

  • CVE-2021-23926
    38Monitor

    XMLBeans XML Entity Expansion

    CriticalCVSS 9.1No exploitEPSS 6%

    apache · xmlbeansJan 14, 2021

  • CVE-2020-24590
    36Monitor

    The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

    CriticalCVSS 9.1No exploitEPSS 1%

    wso2 · api managerAug 21, 2020

  • CVE-2026-45304
    34Monitor

    Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

    HighCVSS 8.7No exploitEPSS 0%

    sensiolabs · symfonyJul 14, 2026

  • CVE-2026-78681
    34Monitor

    NLTK before 3.10.3 Entity Expansion DoS via ElementTree

    HighCVSS 8.7No exploitEPSS 0%

    nltk · nltkAug 25, 2026

  • CVE-2026-73569
    34Monitor

    fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

    HighCVSS 8.7No exploitEPSS 0%

    naturalintelligence · fast-xml-parserAug 13, 2026

  • CVE-2026-3415
    34Monitor

    XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

    HighCVSS 8.7No exploitEPSS 0%

    wso2 · wso2 api managerAug 6, 2026

  • CVE-2019-12401
    33Monitor

    Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a.

    HighCVSS 7.5Proof of conceptEPSS 8%

    apache · solrSep 10, 2019

  • CVE-2022-0217
    32Monitor

    It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in pars

    HighCVSS 7.5No exploitEPSS 5%

    prosody · prosodyAug 26, 2022

  • CVE-2024-28982
    32Monitor

    Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference

    HighCVSS 8.2No exploitEPSS 0%

    hitachi · pentaho business analytics serverJun 26, 2024

  • CVE-2019-5427
    31Monitor

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursi

    HighCVSS 7.5Proof of conceptEPSS 4%

    mchange · c3p0Apr 22, 2019

  • CVE-2011-1755
    31Monitor

    jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of servic

    HighCVSS 7.5No exploitEPSS 3%

    jabberd2 · jabberd2Jun 20, 2011

  • CVE-2022-25857
    31Monitor

    Denial of Service (DoS)

    HighCVSS 7.5No exploitEPSS 2%

    snakeyaml project · snakeyamlAug 30, 2022

  • CVE-2015-9541
    31Monitor

    Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a relat

    HighCVSS 7.5No exploitEPSS 2%

    qt · qtJan 24, 2020

  • CVE-2019-20104
    31Monitor

    The OpenID client application in Atlassian Crowd before version 3.6.2, and from version 3.7.0 before 3.7.1 allows remote attackers to perfor

    HighCVSS 7.5No exploitEPSS 2%

    atlassian · crowdFeb 5, 2020

  • CVE-2020-5227
    31Monitor

    Feedgen Vulnerable to XML Denial of Service Attacks

    HighCVSS 7.5No exploitEPSS 2%

    feedgen project · feedgenJan 28, 2020

  • CVE-2012-6685
    31Monitor

    Nokogiri before 1.5.4 is vulnerable to XXE attacks

    HighCVSS 7.5No exploitEPSS 2%

    nokogiri · nokogiriFeb 19, 2020

  • CVE-2024-28757
    31Monitor

    libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityP

    HighCVSS 7.5Proof of conceptEPSS 2%

    libexpat project · libexpatMar 10, 2024

  • CVE-2022-26662
    31Monitor

    An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x

    HighCVSS 7.5No exploitEPSS 1%

    tryton · proteusMar 10, 2022

  • CVE-2022-33977
    31Monitor

    untangle is a python library to convert XML data to python objects.

    HighCVSS 7.5No exploitEPSS 1%

    untangle project · untangleJul 26, 2022

  • CVE-2011-3288
    31Monitor

    Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a de

    HighCVSS 7.5No exploitEPSS 1%

    cisco · unified presenceOct 6, 2011

All vulnerability classes