CWE-611: XML external entity (XXE)
1,370 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 8 of them as exploited in the wild.
- Published CVEs
- 1,370
- Last 12 months
- 201
- Critical
- 255
- Known exploited
- 8
Critical 255High 626Medium 460Low 29Not scored 0
CVEs per yearBy the year they were published
- 201894
- 2019114
- 2023136
- 202355
- 202320
- 202318
- 2024118
- 2025102
- 2026164
- 2026105
- 2026121
- 2026123
Known exploitedNewest addition to KEV first
- CVE-2025-58360
GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
geoserver · geoserver
ExploitedHigh8.2 - CVE-2025-2776
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
SysAid · SysAid On-Prem
ExploitedCritical9.3 - CVE-2025-2775
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
SysAid · SysAid On-Prem
ExploitedCritical9.3 - CVE-2023-45727
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier…
North Grid Corporation · Proself Enterprise/Standard Edition
ExploitedHigh7.5 - CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
Adobe · Adobe Commerce
ExploitedCritical9.8 - CVE-2019-9670
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by…
Product not named
ExploitedCritical9.8 - CVE-2019-13608
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
Product not named
ExploitedHigh7.5 - CVE-2016-9563
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the…
Product not named
ExploitedMedium6.5
Newest CVEs
- CVE-2026-92198
Quest Foglight for Databases getSource XML External Entity Processing Information Disclosure Vulnerability
Quest · Foglight for Databases
High8.2 - CVE-2026-92185
Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability
Quest · Foglight for Databases
High7.2 - CVE-2026-114552
MailEnable parseObjectResponse XML External Entity Processing Information Disclosure Vulnerability
MailEnable · MailEnable
Medium6.5 - CVE-2026-61586
Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)
copernik-eu · copernik-xml-factory
High8.2 - CVE-2026-93570
XML External Entity injection in Szafir and Szafir Weryfikująca
Krajowa Izba Rozliczeniowa · Szafir
High8.2 - CVE-2026-66090
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
Apereo Foundation · openEQUELLA
High7.1 - CVE-2026-66089
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
Apereo Foundation · openEQUELLA
Medium6.1 - CVE-2026-118039
XML External Entity Reference in Telerik Document Processing Libraries SVG Image Processing
Progress Software · Telerik Document Processing Libraries
High7.5 - CVE-2026-112198
Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
Tactis · NoviGest Desktop App
High8.3 - CVE-2026-90885
Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
Apache Software Foundation · Apache Camel
High7.5