CVE-2026-2252

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references.

This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.

Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611 CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-225207.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-fr CVE-2026-225217.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Fr CVE-2026-225226.5Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Securit CVE-2026-225237.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra WordPress Admin ult CVE-2026-225247.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Legacy Admin legacy-admin CVE-2026-22537.7Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent cert CVE-2026-225358.9An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT CVE-2026-225368.6The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any CVE-2026-225376.8The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text CVE-2026-225395.3As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information abo CVE-2026-22546.3Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, does not apply ACLs o CVE-2026-225409.2The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since t