CWE-611: XML external entity (XXE)

Newest addition to KEV first.

• CVE-2025-58360

  GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

  geoserver · geoserver

  ExploitedHigh8.2
• CVE-2025-2776

  SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection

  SysAid · SysAid On-Prem

  ExploitedCritical9.3
• CVE-2025-2775

  SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection

  SysAid · SysAid On-Prem

  ExploitedCritical9.3
• CVE-2023-45727

  Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier…

  North Grid Corporation · Proself Enterprise/Standard Edition

  ExploitedHigh7.5
• CVE-2024-34102

  XXE can expose crypt key and other secrets granting full admin access

  Adobe · Adobe Commerce

  ExploitedCritical9.8
• CVE-2019-9670

  mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by…

  Product not named

  ExploitedCritical9.8
• CVE-2019-13608

  Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.

  Product not named

  ExploitedHigh7.5
• CVE-2016-9563

  BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the…

  Product not named

  ExploitedMedium6.5