CVE-2018-1000546

Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure, server-side request forgery, or remote code execution. This attack appear to be exploitable via Specially crafted game data file (XML).

• CWE-611

• https://0dd.zone/2018/05/31/TripleA-XXE/Exploit, Third Party Advisory
• https://github.com/triplea-game/triplea/issues/3442Exploit, Third Party Advisory
• https://0dd.zone/2018/05/31/TripleA-XXE/Exploit, Third Party Advisory
• https://github.com/triplea-game/triplea/issues/3442Exploit, Third Party Advisory

Published

Jun 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000540LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c6…
• CVE-2018-1000541Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000542netbeans-mmd-plugin version <= 1.4.3 contains a XML External…
• CVE-2018-1000543Akiee version 0.0.3 contains a XSS leading to code execution…
• CVE-2018-1000544rubyzip gem rubyzip version 1.2.1 and earlier contains a Dir…9.8
• CVE-2018-1000545Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-1000547coreBOS version 7.0 and earlier contains a Incorrect Access …5.3
• CVE-2018-1000548Umlet version < 14.3 contains a XML External Entity (XXE) vu…
• CVE-2018-1000549Wekan version 1.04.0 contains a Email / Username Enumeration…
• CVE-2018-1000550The Sympa Community Sympa version prior to version 6.2.32 co…
• CVE-2018-1000551Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling v…
• CVE-2018-1000552Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulne…