Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
SAXParser is created from SAXParserFactory without disabling DOCTYPE declarations or external entity resolution. This can lead to XML External Entity (XXE) injection vulnerabilities when parsing untrusted XML data. Ensure `disallow-doctype-decl` or entity resolution features are explicitly disabled.
A custom lxml `Resolver` fetches external resources without apparent restriction checks. This can lead to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) vulnerabilities if the application parses WSDLs or XML schemas from untrusted sources. Ensure that external module resolution is securely guarded by a configuration check before making netwo
GeoTools `org.geotools.xsd.Parser` does not disable external entity resolution by default. Parsing XML/GML without setting a custom `EntityResolver` (e.g. `parser.setEntityResolver(...)`) can allow XML External Entity (XXE) attacks.
A `net.sf.saxon.TransformerFactoryImpl` or `TransformerFactory` was instantiated without secure configuration. Ensure `FEATURE_SECURE_PROCESSING` is enabled, or `ACCESS_EXTERNAL_DTD` is disabled, to prevent XML External Entity (XXE) attacks.
Directly chaining `DocumentBuilderFactory.newInstance().newDocumentBuilder()` prevents configuring the XML parser to restrict XML External Entities (XXE). An attacker can provide malicious XML data leading to local file disclosure or SSRF. Instantiate the factory separately, apply security features (e.g., `setFeature("http://apache.org/xml/features/disallow-
Chaining `DocumentBuilderFactory.newInstance().newDocumentBuilder()` prevents secure configuration of the XML parser, leaving it vulnerable to XML External Entity (XXE) injection. Instantiate the factory separately and disable DTDs and external entities before creating the DocumentBuilder.
Directly calling DocumentBuilderFactory.newInstance().newDocumentBuilder() creates a DocumentBuilder from an unconfigured DocumentBuilderFactory, leaving XML External Entity (XXE) processing enabled by default. Configure feature flags on a DocumentBuilderFactory instance (such as disabling DTDs) or use a secure XML builder helper.
Setting DOMDocument::$validateOnParse to true enables explicit DTD validation, which overrides modern libxml protections and resolves external entities. When combined with load() or loadXML(), this causes an XXE vulnerability.
Evaluating XPath expressions using `elementpath` default parsers (XPath2Parser, XPath3Parser, etc.) is unsafe because they support dangerous functions such as `unparsed-text()`, `doc()`, and `environment-variable()`. An attacker can use these functions to read arbitrary files or leak environment variables. Evaluate untrusted XPath using a custom parser with
A JDOM2 SAXBuilder was created without explicitly disabling external DTDs or schemas. This can lead to XML External Entity (XXE) injection vulnerabilities when parsing untrusted XML documents. Ensure you secure the SAXBuilder by setting XMLConstants.ACCESS_EXTERNAL_DTD to an empty string.
GeoNetwork release version is < 4.4.10, which transitively depends on a GeoTools version vulnerable to CVE-2025-30220 (XXE / SSRF in gt-xsd-core Schemas and gt-wfs-ng DataStore not honoring EntityResolver) and predates the addition of @PreAuthorize("hasAuthority('Editor')") on WFSHarvesterApi.indexWfs. Upgrade to 4.4.10 or later, which bumps the GeoTools dep
Unconfigured 'DocumentBuilderFactory' is vulnerable to XML External Entity (XXE) attacks. Ensure that external entities and doctypes are disabled by calling 'setFeature' or by using a safely pre-configured factory method.
The application parses XML using the `LIBXML_DTDLOAD` or `LIBXML_DTDATTR` flags. These flags enable the loading of external DTDs or default DTD attributes. On modern PHP versions (8.0+), this can lead to XML External Entity (XXE) or Server-Side Request Forgery (SSRF) vulnerabilities when parsing untrusted XML, as traditional entity loader disablement methods
The application instantiates an XML TransformerFactory without enabling XMLConstants.FEATURE_SECURE_PROCESSING. This unsafe default configuration allows the execution of arbitrary Java extension functions embedded within XSL stylesheets, leading to Remote Code Execution (RCE). Ensure that FEATURE_SECURE_PROCESSING is set to true.
XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611External XML entities are a feature of XML parsers that allow documents to contain references to other documents or data. This feature can be abused to read files, communicate with external hosts, exfiltrate data, or cause a Denial of Service (DoS). The XMLReaderFactory has been deprecated. It is recommended that [SAXParserFactory](https://docs.oracle.com/ja
JavaCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
KotlinCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611User controlled data in XML parsers can result in XML External or Internal Entity (XXE) Processing vulnerabilities
JSCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
KotlinCWE-611XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source.
ScalaCWE-611The input values included in SQL queries need to be passed in safely. Bind variables in prepared statements can be used to easily mitigate the risk of SQL injection.
ScalaCWE-611
