Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Evaluating XPath expressions using `elementpath` default parsers (XPath2Parser, XPath3Parser, etc.) is unsafe because they support dangerous functions such as `unparsed-text()`, `doc()`, and `environment-variable()`. An attacker can use these functions to read arbitrary files or leak environment variables. Evaluate untrusted XPath using a custom parser with
A JDOM2 SAXBuilder was created without explicitly disabling external DTDs or schemas. This can lead to XML External Entity (XXE) injection vulnerabilities when parsing untrusted XML documents. Ensure you secure the SAXBuilder by setting XMLConstants.ACCESS_EXTERNAL_DTD to an empty string.
GeoNetwork release version is < 4.4.10, which transitively depends on a GeoTools version vulnerable to CVE-2025-30220 (XXE / SSRF in gt-xsd-core Schemas and gt-wfs-ng DataStore not honoring EntityResolver) and predates the addition of @PreAuthorize("hasAuthority('Editor')") on WFSHarvesterApi.indexWfs. Upgrade to 4.4.10 or later, which bumps the GeoTools dep
Unconfigured 'DocumentBuilderFactory' is vulnerable to XML External Entity (XXE) attacks. Ensure that external entities and doctypes are disabled by calling 'setFeature' or by using a safely pre-configured factory method.
The application parses XML using the `LIBXML_DTDLOAD` or `LIBXML_DTDATTR` flags. These flags enable the loading of external DTDs or default DTD attributes. On modern PHP versions (8.0+), this can lead to XML External Entity (XXE) or Server-Side Request Forgery (SSRF) vulnerabilities when parsing untrusted XML, as traditional entity loader disablement methods
The application instantiates an XML TransformerFactory without enabling XMLConstants.FEATURE_SECURE_PROCESSING. This unsafe default configuration allows the execution of arbitrary Java extension functions embedded within XSL stylesheets, leading to Remote Code Execution (RCE). Ensure that FEATURE_SECURE_PROCESSING is set to true.
XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611External XML entities are a feature of XML parsers that allow documents to contain references to other documents or data. This feature can be abused to read files, communicate with external hosts, exfiltrate data, or cause a Denial of Service (DoS). The XMLReaderFactory has been deprecated. It is recommended that [SAXParserFactory](https://docs.oracle.com/ja
JavaCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
KotlinCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611User controlled data in XML parsers can result in XML External or Internal Entity (XXE) Processing vulnerabilities
JSCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
KotlinCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection.
ScalaCWE-611Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.
JSCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
KotlinCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611The application was found using the `xml.sax.expatreader` package for processing XML. Python's default XML processors suffer from various XML parsing vulnerabilities and care must be taken when handling XML data. Additionally, depending on the version of Python, more critical vulnerabilities such as eXternal XML Entity injection maybe exploitable. The `xml.s
PythonCWE-611The application was found using the `xml.sax` package for processing XML. Python's default XML processors suffer from various XML parsing vulnerabilities and care must be taken when handling XML data. Additionally, depending on the version of Python, more critical vulnerabilities such as eXternal XML Entity injection maybe exploitable. The `xml.sax` package
PythonCWE-611The application was found using the `xml.etree` package for processing XML. Pythons default xml processors suffer from various XML parsing vulnerabilities and care must be taken when handling XML data. Additionally, depending on the version of Python, more critical vulnerabilities such as eXternal XML Entity injection maybe exploitable. The `etree` package s
PythonCWE-611The application was found using the `xml.etree` package for processing XML. Pythons default xml processors suffer from various XML parsing vulnerabilities and care must be taken when handling XML data. Additionally, depending on the version of Python, more critical vulnerabilities such as eXternal XML Entity injection maybe exploitable. The `etree` package s
PythonCWE-611The application was found using the `lxml.etree` package for processing XML. Python's default XML processors suffer from various XML parsing vulnerabilities and care must be taken when handling XML data. Additionally, depending on the version of Python, more critical vulnerabilities such as eXternal XML Entity injection maybe exploitable. The `etree` package
PythonCWE-611
