CVE-2021-4295

A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability.

• CWE-611
• CWE-611

• https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b13f235bc8b61d8449afPatch, Third Party Advisory
• https://github.com/onc-healthit/code-validator-api/pull/97Third Party Advisory
• https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31Third Party Advisory
• https://vuldb.com/?ctiid.217018Third Party Advisory
• https://vuldb.com/?id.217018Third Party Advisory
• https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b13f235bc8b61d8449afPatch, Third Party Advisory
• https://github.com/onc-healthit/code-validator-api/pull/97Third Party Advisory
• https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31Third Party Advisory
• https://vuldb.com/?ctiid.217018Third Party Advisory
• https://vuldb.com/?id.217018Third Party Advisory

Published

Dec 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42940A Cross Site Scripting (XSS) vulnerability exists in Projeqt…9.9
• CVE-2021-42943Stored cross-site scripting (XSS) in admin/usermanager.php o…5.4
• CVE-2021-42945A SQL Injection vulnerability exists in ZZCMS 2021 via the a…9.8
• CVE-2021-42946A Cross Site Scripting (XSS) vulnerability exists in htmly.2…4.8
• CVE-2021-42948HotelDruid Hotel Management Software v3.0.3 and below was di…3.7
• CVE-2021-42949The component controlla_login function in HotelDruid Hotel M…9.8
• CVE-2021-42950Remote Code Execution (RCE) vulnerability exists in Zepl Not…8.8
• CVE-2021-42951A Remote Code Execution (RCE) vulnerability exists in Algori…8.8
• CVE-2021-42952Zepl Notebooks before 2021-10-25 are affected by a sandbox e…9.9
• CVE-2021-42954Zoho Remote Access Plus Server Windows Desktop Binary fixed …7.8
• CVE-2021-42955Zoho Remote Access Plus Server Windows Desktop binary fixed …7.8
• CVE-2021-42956Zoho Remote Access Plus Server Windows Desktop Binary fixed …8.8