CVE-2024-58335

MediumCVSS 5.0/10Last modified Oct 27, 2026

Description

OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImpl.java.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
jcthieleOpenXRechnungToolbox< 6c50e8979924b09f336c976cbad3a9ebfe25ebf9

References

Timeline

Published
Dec 24, 2025
Last modified
Oct 27, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-583365.3Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requestingCVE-2024-583374.3Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access sCVE-2024-5833810.0Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through CVE-2024-583397.5LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VanCVE-2024-58348.8Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craftCVE-2024-583407.5LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.paCVE-2024-583418.2OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injectiCVE-2024-583426.1XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately valiCVE-2024-583434.3Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_idCVE-2024-583446.4Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavCVE-2024-583489.8WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to uploaCVE-2024-583499.8WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious