CVE-2018-20059: Pippo xml external entity (xxe) vulnerability

Pippo · Pippo

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.

9.8 CVSS 3.0 Critical EPSS 1.5% · top 26.8% CWE-611 · XML external entity (XXE)

9.8CVSS 3.0 base score, v2 7.5

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Pippo Pippo

References

Link	Tags
https://github.com/pippo-java/pippo/issues/486	ExploitIssue TrackingThird Party Advisory
https://github.com/pippo-java/pippo/issues/486	ExploitIssue TrackingThird Party Advisory

Track CVE-2018-20059 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-18349Alibaba fastjson improper input validation vulnerabilityparseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary cod…EPSS 39%23 Oct 2018 9.8CVE-2018-18628Pippo deserialization of untrusted data vulnerabilityAn issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize…EPSS 5.5%23 Oct 2018 9.8CVE-2018-18240Pippo deserialization of untrusted data vulnerabilityPippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream'…EPSS 3.7%11 Oct 2018 7.5CVE-2019-5442Pippo vulnerabilityXML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap …EPSS 1.4%12 Jun 2019 9.8CVE-2025-58360GeoServer WMS GetMap XXE allows unauthenticated file read and SSRFGeoServer versions 2.26.0 through 2.26.2 and before 2.25.6 accept XML input at the /geoserver/wms GetMap endpoint without sufficiently restricting ex…KEVEPSS 61%analysed25 Nov 2025 9.8CVE-2025-2776SysAid On-Prem unauthenticated XXE in Server URL processingSysAid On-Prem versions up to 23.3.40 process the Server URL without restricting XML external entities, so an unauthenticated attacker can supply cra…KEVEPSS 64%analysed7 May 2025 7.5CVE-2025-2775SysAid On-Prem unauthenticated XXE in Checkin processingSysAid On-Prem versions up to 23.3.40 process Checkin XML without restricting external entities, so an unauthenticated attacker can supply a crafted …KEVEPSS 43%analysed7 May 2025 7.5CVE-2023-45727Proself XXE flaw allows unauthenticated file readProself Enterprise/Standard, Gateway, and Mail Sanitize editions fail to restrict XML external entities when parsing malformed XML requests. A remote…KEVEPSS 3.5%analysed18 Oct 2023

Source: NIST National Vulnerability Database (record CVE-2018-20059), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.