CVE-2018-19858

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an attacker passes HTML referencing an XML file (e.g., in an IFRAME element), PrinceXML will fetch the XML and parse it, thus giving an attacker file-read access and full-fledged SSRF.

Metrics

CVSS 3.0 8.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://hacking.us.com/blog/XSS-to-XXE-in-Prince/Exploit, Third Party Advisory
https://www.lynxsecurity.io/Third Party Advisory
https://www.youtube.com/watch?v=-7YIzYtWhzMExploit, Third Party Advisory
https://hacking.us.com/blog/XSS-to-XXE-in-Prince/Exploit, Third Party Advisory
https://www.lynxsecurity.io/Third Party Advisory
https://www.youtube.com/watch?v=-7YIzYtWhzMExploit, Third Party Advisory

Timeline

Published: Jan 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-198596.5OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.CVE-2018-198608.8Broadcom firmware before summer 2014 on Nexus 5 BCM4335C0 2012-12-11, Raspberry Pi 3 BCM43438A1 2014-06-02, and unspecifed other devices doe CVE-2018-198619.8Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request. NOTE: this p CVE-2018-198629.8Buffer overflow in MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP POST request. NOTE: this p CVE-2018-198635.5An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. A mistake in error logging resulted in instances where sensiti CVE-2018-198649.8NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (CVE-2018-198657.5A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.CVE-2018-198696.5An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in qsvghandler.cpp.CVE-2018-19877.8IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be di CVE-2018-198708.8An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentat CVE-2018-198716.5An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.CVE-2018-198725.5An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.