CVE-2021-42194

The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ String function, which itself does not prohibit external entities, triggering a XML external entity (XXE) injection vulnerability.

• CWE-611

• https://github.com/eyoucms/eyoucms/issues/19Exploit, Issue Tracking, Third Party Advisory
• https://github.com/eyoucms/eyoucms/issues/19Exploit, Issue Tracking, Third Party Advisory

Published

Mar 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42183MasaCMS 7.2.1 is affected by a path traversal vulnerability …7.5
• CVE-2021-42185wdja v2.1 is affected by a SQL injection vulnerability in th…9.8
• CVE-2021-42186Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-4219A flaw was found in ImageMagick. The vulnerability occurs du…5.5
• CVE-2021-42192Konga v0.14.9 is affected by an incorrect access control vul…8.8
• CVE-2021-42193nopCommerce 4.40.3 is vulnerable to XSS in the Product Name …6.1
• CVE-2021-42195An issue was discovered in swftools through 20201222. A heap…7.8
• CVE-2021-42196An issue was discovered in swftools through 20201222. A NULL…5.5
• CVE-2021-42197An issue was discovered in swftools through 20201222 through…7.8
• CVE-2021-42198An issue was discovered in swftools through 20201222. A NULL…5.5
• CVE-2021-42199An issue was discovered in swftools through 20201222. A heap…7.8
• CVE-2021-4220Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…