cve.bz

CWE-91: XML Injection (Blind XPath Injection), page 3

Filter

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

What the weakness is: CWE-91 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 2
  • CAPEC-83 XPath Injection Likelihood: High · Severity: High
  • CAPEC-250 XML Injection Likelihood: High

The attack patterns MITRE's CAPEC relates to CWE-91, as MITRE names them. Credits.

Ask an AI about CWE-91

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-91: XML Injection and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/91.html and https://cve.bz/cve/cwe/91?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.2CVE-2021-32758EPSS 2.0%

    OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.1…

  2. 9.8CVE-2021-37154EPSS 1.4%

    In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

  3. 5.3CVE-2021-32796EPSS 1.4%

    xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their …

  4. 8.8CVE-2021-2322EPSS 1.4%

    Vulnerability in OpenGrok (component: Web App). Versions that are affected are 1.6.7 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise OpenGrok. Successful attacks of thi…

  5. 6.5CVE-2021-31347EPSS 1.1%

    An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling while parsing crafted XML files (writing outside a memory region created by mmap).

  6. 9.1CVE-2021-21025EPSS 3.3%

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker…

  7. 9.1CVE-2021-21019EPSS 3.6%

    Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access…

  8. 7.8CVE-2020-29599EPSS 7.5%

    ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefo…

  9. 8.6CVE-2017-15685EPSS 1.7%

    Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

  10. 8.6CVE-2017-15683EPSS 1.5%

    In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.

  11. 9.8CVE-2020-29128EPSS 2.3%

    petl before 1.68, in some configurations, allows resolution of entities in an XML document.

  12. 5.4CVE-2020-4774EPSS 0.8%

    An XPath vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, caused by the improper handling of user-supplied input. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to obt…

  13. 9.8CVE-2020-25216EPSS 2.4%

    yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet.

  14. 8.2CVE-2020-6271EPSS 1.2%

    SAP Solution Manager (Problem Context Manager), version 7.2, does not perform the necessary authentication, allowing an attacker to consume large amounts of memory, causing the system to crash and read restricted data (files visible for te…

  15. 5.3CVE-2020-6260EPSS 0.8%

    SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to inject superflous data that can be displayed by the application, due to Incomplete XML Validation. The application shows additional data that do not actually exist.

  16. 9.8CVE-2020-8479EPSS 2.3%

    For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ O…

  17. 9.8CVE-2020-11535EPSS 2.3%

    An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit XML injection to enter an attacker-controlled parameter into the x2t binary, to rewrite this binary and/or libxcb.so.1, …

  18. 9.8CVE-2015-6970ExploitEPSS 5.3%

    The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.

  19. 9.8CVE-2020-0646KEVExploitEPSS 99.2%

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

  20. 9.1CVE-2014-1409EPSS 4.0%

    MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords

  21. 8.8CVE-2018-1721EPSS 1.8%

    IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or cause the web server to make H…

  22. 9.8CVE-2019-8158EPSS 1.3%

    An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine …

  23. 8.8CVE-2019-17323EPSS 1.6%

    ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of rexpert viewer with modified XML document. User interaction is required to exploit this vulnerability in that the targ…

  24. 9.8CVE-2013-4857EPSS 1.6%

    D-Link DIR-865L has PHP File Inclusion in the router xml file.

  25. 9.8CVE-2019-17626EPSS 9.5%

    ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

  26. 6.5CVE-2019-0370EPSS 0.7%

    Due to missing input validation, SAP Financial Consolidation, before versions 10.0 and 10.1, enables an attacker to use crafted input to interfere with the structure of the surrounding query leading to XPath Injection.

  27. 7.1CVE-2019-4539EPSS 1.2%

    IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 16581…

  28. 9.8CVE-2019-16941EPSS 5.1%

    NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/gh…

  29. 9.8CVE-2019-14277EPSS 7.3%

    Axway SecureTransport 5.x through 5.3 (or 5.x through 5.5 with certain API configuration) is vulnerable to unauthenticated blind XML injection (and XXE) in the resetPassword functionality via the REST API. This vulnerability can lead to lo…

  30. 7.5CVE-2019-1010017EPSS 1.5%

    libnmap < v0.6.3 is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.

  31. 6.5CVE-2019-9892EPSS 1.1%

    An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully craft…

  32. 8.1CVE-2019-0268EPSS 2.2%

    SAP BusinessObjects Business Intelligence Platform (CMC Module), versions 4.10, 4.20 and 4.30, does not sufficiently validate an XML document accepted from an untrusted source.

  33. 8.8CVE-2018-19277ExploitEPSS 7.8%

    securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

  34. 8.8CVE-2018-2477EPSS 1.7%

    Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted from an untrusted source.

  35. 7.2CVE-2018-16784EPSS 2.3%

    DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.

  36. 8.8CVE-2018-16785EPSS 1.9%

    XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell

  37. 7.5CVE-2018-1000632EPSS 6.6%

    dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear …

  38. 7.5CVE-2018-1000526EPSS 2.0%

    Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via Specially crafted XML file. This vulnerability appears to have been fixed in af…

  39. 7.5CVE-2016-6272ExploitEPSS 21%

    XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as…

  40. 7.5CVE-2017-1000452EPSS 1.4%

    An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.

  41. 9.8CVE-2013-7429EPSS 2.2%

    The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to conduct XML injection attacks via the url parameter to plugin_googlemap2_proxy.php.

  42. 7.8CVE-2015-3932EPSS 2.1%

    Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.

  43. 7.8CVE-2015-3931EPSS 2.1%

    Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.

  44. 7.8CVE-2017-10603EPSS 0.4%

    An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are J…

  45. 6.1CVE-2017-2171EPSS 0.9%

    Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admi…

  46. 7.5CVE-2017-5654EPSS 2.2%

    In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari server executes.

  47. 7.5CVE-2016-5697EPSS 1.2%

    Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

  48. 5.3CVE-2016-2932EPSS 1.4%

    IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors.

  49. –CVE-2013-4221EPSS 3.4%

    The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

  50. –CVE-2008-5024EPSS 3.6%

    Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attackers to conduct XML i…