Search Vulnerabilities

XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers

guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

pam_usb: XPath injection via PAM-supplied identifiers in pam_usb configuration queries

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

fast-xml-builder: Comment Value bypass regex

fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

xmldom: XML node injection through unvalidated processing instruction serialization

xmldom: XML injection through unvalidated DocumentType serialization

xmldom: XML node injection through unvalidated comment serialization

traccar allows XML injection in KML and GPX exports

Kirby has XML injection in its XML creator toolkit

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101

Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007

Wondershare FamiSafe 1.0 - 'FSService' Unquoted Service Path

WatchGuard Firebox XPath Injection Vulnerability in Web CGI

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib