Unauthenticated XXE leading to SSRF and internal resource access
Medium2026-09-30
Web
Not rated
BUG BOUNTY WRITEUPS
XXE writeups
XML external entity bugs: reading files and making requests through XML parsers, including in document and SVG uploads.
12 reports and writeups from 2024 to 2026. 3 carry a severity from the disclosing platform, 3 of them rated High or Critical. Last updated 2026-10-30.
Latest XXE reports
Search and filter all writeupsXML E██████ternal Entity (XXE) Injection in ███
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
The Hunt for XXE to LFI: How I Uncovered CVE-2019–9670 in a Bug Bounty Program
InfoSec Write-ups2024-08-31
Web
Not rated
XML External Entity (XXE) Injection
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
XXE with RCE potential on the https://█████████ (CVE-2017-3548)
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
Why nested deserialization is harmful: Magento XXE (CVE-2024-34102)
Researcher blogMagento2024-06-26
Web, Source Code
Not rated
Getting XXE in Web Browsers using ChatGPT
Researcher blogApple (Safari), Google (Chrome), libxslt2024-05-22$28,000 bounty
Web, AI
Not rated
OpenOlat - XML external entity (XXE) injection (CVE-2024-28198)
Researcher blogOpenOlat2024-03-12
Web, Source Code
Not rated
xmlrpc.php &wp-cron.php files are enabled, and will used for (DDOS),(DOS) and broutforce users attack.
HackerOneNextcloud2024-02-08
Web, Cloud
Not rated
Azure HDInsight: The Sequel – Unveiling 3 New Vulnerabilities That Could Have Led to Privilege Escalations and Denial of Service
Researcher blogMicrosoft (Azure HDInsight)2024-02-06
Web, Cloud, Source Code
Not rated
XML External Entity injection with error-based data exfiltration
InfoSec Write-ups2024-01-29
Web
Not rated
Exploiting a difficult Out-Of-Band XXE via FTP connections.
Medium2024-01-05
Web
Not rated
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.