CWE-112: Missing XML Validation
The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
Last updated
Overview
Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input.
Real-world CVEs
7 recorded CVEs are caused by CWE-112 (Missing XML Validation). The highest-severity and most recent are shown first. 1 new CWE-112 CVE has been recorded so far in 2026.