Base weakness
Draft
CWE-112: Missing XML Validation
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Last updated
7
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input.
Real-world CVEs
7 recorded CVEs are caused by CWE-112 (Missing XML Validation). The highest-severity and most recent are shown first. 1 new CWE-112 CVE has been recorded so far in 2026.