Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.1, updated 2026-10-28. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-34102 KEV | magento/community-edition, magento/product-community-edition | Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | critical | 9.8 | 100% |
| CVE-2021-29447 | WordPress core | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr | high | 7.1 | 86% |
| CVE-2012-3363 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | high | 7.3 | 49% |
| CVE-2011-4107 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to XML external entity (XXE) injection attack | medium | 6.5 | 13% |
| CVE-2012-4399 | cakephp/cakephp | CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references | high | 7.5 | 12% |
| CVE-2015-5161 | zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml | ZendXml and Zend Framework contain XXE and XEE Vulnerabilities | medium | 0.0 | 10% |
| CVE-2014-2053 | james-heinrich/getid3 | getID3 is vulnerable to XML External Entity (XXE) | high | 0.0 | 5% |
| CVE-2024-45293 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | 3% |
| CVE-2014-2681 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 3% |
| CVE-2020-25911 | modx/revolution | XML External Entity vulnerability in MODX CMS | critical | 9.1 | 2% |
| CVE-2014-2683 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2014-2682 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2018-14065 | phpoffice/common | PHPOffice Common Improper Restriction of XML External Entity Reference | critical | 9.8 | 2% |
| CVE-2012-5657 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | medium | 0.0 | 2% |
| CVE-2023-38490 | getkirby/cms | XML External Entity (XXE) vulnerability in the XML data handler | medium | 6.8 | 2% |
| CVE-2015-3907 | chriskacerguis/codeigniter-restserver | CodeIgniter Rest Server XXE Vulnerability | critical | 9.8 | 2% |
| CVE-2014-2054 | phpoffice/phpexcel | PHPExcel vulnerable to XXE attacks through libxml | medium | 0.0 | 2% |
| CVE-2014-3543 | moodle/moodle | Moodle Arbitrary File Read via XML External Entity vulnerability | medium | 0.0 | 1% |
| CVE-2019-12331 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue | high | 8.8 | 1% |
| CVE-2020-25750 | devgroup/dotplant | DotPlant2 Improper Restriction of XML External Entity Reference | high | 7.5 | 1% |
| CVE-2017-1000477 | desperado/xml-bundle | XXE Vulnerability in XMLBundle 0.1.7 | high | 7.5 | 1% |
| CVE-2024-52596 | simplesamlphp/xml-common | SimpleSAMLphp xml-common XXE vulnerability | high | 0.0 | 1% |
| CVE-2021-3902 | dompdf/dompdf | Improper Restriction of XML External Entity Reference in dompdf/dompdf | critical | 9.8 | 1% |
| CVE-2019-8126 | magento/community-edition, magento/product-community-edition | Information disclosure through processing of external XML entities | medium | 4.9 | 1% |
| CVE-2015-10029 | kelvinmo/simplexrd | kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference | critical | 9.8 | 1% |
| CVE-2020-25817 | silverstripe/framework | SilverStripe XXE Vulnerability in CSSContentParser | medium | 4.8 | 1% |
| CVE-2024-47873 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XmlScanner bypass leads to XXE | high | 7.5 | 1% |
| CVE-2024-48917 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | 1% |
| CVE-2022-43689 | concrete5/concrete5 | Concrete CMS vulnerable to XML External Entity | medium | 5.3 | 1% |
| CVE-2020-26229 | typo3/cms, typo3/cms-core | XML External Entity in Dashboard Widget | low | 3.7 | 1% |
| CVE-2024-45048 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet encoding is returned | high | 8.8 | 1% |
| CVE-2026-45071 | symfony/dom-crawler, symfony/symfony | Symfony has XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true | low | 0.0 | 1% |
| CVE-2025-48882 | phpoffice/math | PHPOffice Math allows XXE when processing an XML file in the MathML format | high | 0.0 | 0% |
| CVE-2026-108358 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2025-47778 | sulu/sulu | Sulu vulnerable to XXE in SVG File upload Inspector | medium | 0.0 | 0% |
| CVE-2024-52806 | simplesamlphp/saml2, simplesamlphp/saml2-legacy | SimpleSAMLphp SAML2 has an XXE in parsing SAML messages | high | 8.3 | 0% |
| CVE-2026-108357 | phpoffice/phpspreadsheet | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | high | 0.0 | 0% |
| CVE-2026-56701 | getgrav/grav | Grav is Vulnerable to XXE via SVG Upload | medium | 6.5 | 0% |
| CVE-2026-46722 | tpwd/ke_search | TYPO3 ke_search XML External Entity Injection | medium | 0.0 | 0% |
| GHSA-8x2v-pcg7-94f4 | zendframework/zend-json | Zend-JSON vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-f4fj-q6m4-cc52 | zendframework/zend-xmlrpc | ZendFramework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-j68w-pg49-f6vx | symfony/serializer | Symfony XML decoding attack vector through external entities | critical | 9.8 | – |
| GHSA-mhpx-3rv8-wrjm | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | critical | 9.8 | – |
| GHSA-qc7w-4567-84wv | zendframework/zendframework | Zendframework vulnerable to XXE/XEE attacks | critical | 9.8 | – |
| GHSA-229x-22xc-2f2w | zendframework/zendframework1 | Zendframework Local file disclosure via XXE injection in Zend_XmlRpc | high | 8.6 | – |
| GHSA-4j9x-g4x8-vcmf | zendframework/zendframework1 | ZendFramework potential XML eXternal Entity injection vectors | high | 7.5 | – |
| GHSA-c636-cg5r-2498 | symfony/dependency-injection | Symfony XML Entity Expansion security vulnerability | high | 7.5 | – |
| GHSA-rjpm-qmq7-q85w | symfony/routing | Symfony XXE security vulnerability | high | 7.5 | – |
| GHSA-534c-hcr7-67jg | kimai/kimai | Kimai has an XXE Leading to Local File Read | medium | 6.5 | – |
| GHSA-8xv9-qcr9-ww9j | shopware/core, shopware/platform | Authenticated XML External Entity Processing | medium | 5.6 | – |