CVE-2020-10683
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, th
CVSS
9.8
Critical
EPSS
7.3%
p94
KEV
—
Exploit Today
28
0-100
Published: May 1, 2020 · Last modified: Aug 25, 2026 · CWE-611
7.3%EPSS · 30 days7.3%
2026-10-142026-11-11
dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1694235
- cheatsheetseries.owasp.orghttps://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- github.comhttps://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
- github.comhttps://github.com/dom4j/dom4j/commits/version-2.0.3
- github.comhttps://github.com/dom4j/dom4j/issues/87
- github.comhttps://github.com/dom4j/dom4j/releases/tag/version-2.1.3
- lists.apache.orghttps://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20200518-0002/
- usn.ubuntu.comhttps://usn.ubuntu.com/4575-1/
- www.oracle.comhttps://www.oracle.com//security-alerts/cpujul2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuApr2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2020.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-918765.5 MED—
———Dell OpenManage Ansible Modules, versions 2.0.4 through 10.0.3, contains an Improper Restriction of XML External Entity Reference vulnerability in the XML parsing component. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.16hCVE-2026-1051537.7 HIG—
———Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled.22hCVE-2026-90993——
——0XXE vulnerability in Apache XML Graphics Batik.
This issue affects Apache XML Graphics Batik: through 1.19.
Users are recommended to upgrade to version 1.20, which fixes the issue.16hCVE-2026-125883—59.6%
——18Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning.
This issue affects N-central: before 26.4.1.6hCVE-2026-1218907.7 HIG58.3%
——18Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.2dCVE-2026-1218879.9 CRI69.1%
——21Adobe Connect is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.1d