CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
GeoServer GetMap Endpoint XML External Entity (XXE) Injection Vulnerability Advisory (CVE-2025-58360)
[Affected Scope] GeoServer versions from 2.25.0 to before 2.25.6, and from 2.26.0 to before 2.26.3
[Impact] Unauthenticated remote attackers can exploit the GetMap XML request to read arbitrary local files, perform Server-Side Request Forgery (SSRF), or trigger Denial of Service (DoS)
[Mitigation] Immediately upgrade GeoServer to patched versions 2.25.6, 2.26.3, or 2.27.0 and above
SysAid On-Prem Unauthenticated XML External Entity (XXE) Vulnerability (CVE-2025-2776) Technical Advisory
[Affected Scope] SysAid On-Prem versions <= 23.3.40
[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application
SysAid On-Prem Unauthenticated XML External Entity (XXE) Vulnerability (CVE-2025-2775) Security Advisory
[Affected Scope] SysAid On-Prem versions 23.3.40 and below
[Impact] Unauthenticated remote attackers can read arbitrary system files and perform administrator account takeover, leading to full system compromise.
[Mitigation] Immediately upgrade SysAid On-Prem to version 24.4.60 or higher, and restrict external access to the Checkin endpoint prior to patching.
Adobe Commerce and Magento XML External Entity Reference (XXE) Vulnerability (CVE-2024-34102, CosmicSting) Analysis and Mitigation Guide
[Affected Scope] Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier
[Impact] Unauthenticated remote attackers can exploit this vulnerability to read arbitrary files and potentially achieve Remote Code Execution (RCE)
[Mitigation] Apply the official Adobe security patches (APSB24-40) or upgrade to the latest secure releases immediately
Proself Enterprise/Standard/Gateway/Mail Sanitize Edition XML External Entity (XXE) Vulnerability (CVE-2023-45727)
[Affected Scope] Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier
[Impact] A remote unauthenticated attacker can read arbitrary system files and sensitive account credentials by sending specially crafted XML requests
[Mitigation] Immediately upgrade to the latest patched versions provided by the vendor and disable external entity resolution in XML parsers