CWE-91 XML Injection (aka Blind XPath Injection)

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator

samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

veraPDF has potential XSLT injection vulnerability when using policy files

fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

fast-xml-builder Comment Value regex can be bypassed

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

xmldom has XML injection through unvalidated DocumentType serialization

xmldom has XML node injection through unvalidated processing instruction serialization

xmldom has XML node injection through unvalidated comment serialization

Kirby has XML injection in its XML creator toolkit

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Magento has an XML Injection vulnerability

Magento XML Injection vulnerability in the Widgets Module

Magento XML Injection vulnerability in the Widgets Update Layout

Magento XML Injection vulnerability in the 'City' field

MinIO Java Client XML Tag Value Substitution Vulnerability