A county intake form accepts XML uploads and the parser resolves external entities. What risk class should the tester report?
Select an answer to reveal the explanation.
Short Explanation
XML that can phone home or open local files is more than a fancy document — it is a backstage pass. XXE is that parser trust problem. Report the class and likely impacts, not a pile of entity payloads.
Full Explanation
XML External Entity (XXE) vulnerabilities appear when parsers process untrusted XML and resolve external entities or DTDs insecurely. Impact classes include local file disclosure, denial of service, and SSRF-like requests to internal resources. Disable external entities, use safer parsers, and validate inputs. Mail-relay, robots.txt, and guest Wi-Fi findings do not describe this XML upload risk.