CVE-2018-1000836

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.

• CWE-611

• https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM/Third Party Advisory
• https://github.com/Bedework/bw-calendar-engine/issues/3Third Party Advisory
• https://0dd.zone/2018/10/28/bw-calendar-engine-XXE-MitM/Third Party Advisory
• https://github.com/Bedework/bw-calendar-engine/issues/3Third Party Advisory

Published

Dec 20, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000830XR3Player version <= V3.124 contains a XML External Entity (…
• CVE-2018-1000831K9Mail version <= v5.600 contains a XML External Entity (XXE…
• CVE-2018-1000832ZoneMinder version <= 1.32.2 contains a Other/Unknown vulner…
• CVE-2018-1000833ZoneMinder version <= 1.32.2 contains a Other/Unknown vulner…
• CVE-2018-1000834runelite version <= runelite-parent-1.4.23 contains a XML Ex…
• CVE-2018-1000835KeePassDX version <= 2.5.0.0beta17 contains a XML External E…10
• CVE-2018-1000837UML Designer version <= 8.0.0 contains a XML External Entity…10
• CVE-2018-1000838autopsy version <= 4.9.0 contains a XML External Entity (XXE…
• CVE-2018-1000839LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vu…
• CVE-2018-1000840Processing Foundation Processing version 3.4 and earlier con…
• CVE-2018-1000841Zend.To version Prior to 5.15-1 contains a Cross Site Script…
• CVE-2018-1000842FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0…6.1