CVE-2026-92877None▾ SunlitThe JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The JAXB factory methods historically relied solely on FEATURE_SECURE_PROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local files via out-of-band XXE.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-10816High· 7.3A security flaw has been discovered in Jinher OA 2.0
CVE-2025-11341High· 7.3A security flaw has been discovered in Jinher OA up to 2.0
CVE-2025-11035Medium· 6.3A vulnerability was determined in Jinher OA 2.0
CVE-2025-11140High· 7.3A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0
CVE-2022-37911Low· 3.8Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS
CVE-2025-10091High· 7.3A vulnerability has been found in Jinher OA up to 1.2