CVE-2026-3511

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticated attacker to conduct SSRF (Server Side Request Forgery) attacks and obtain unauthorized access to local files on filesystems running the vulnerable application. Successful exploitation requires the victim to visit a specially crafted website that sends request containing a specially crafted XML document to /sign endpoint of the local HTTP server run by the application.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Slovensko.Digital	Autogram	< 2.7.2

References

Timeline

Published: Mar 19, 2026
Last modified: Jun 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-351105.4HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted ove CVE-2026-351114.8HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application r CVE-2026-351124.2HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-orig CVE-2026-351134.8HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin do CVE-2026-351143.7HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff res CVE-2026-351153.7HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so brow CVE-2026-35126.1The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up CVE-2026-35136.4The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' sh CVE-2026-35147.5In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions fo CVE-2026-351407.2HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the CVE-2026-351415.3HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudu CVE-2026-351428.2HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within