CVE-2014-0225

score

<0.1

cvss

8.8

epss

1.7%

published

2017-05-25

kev added

—

first seen

2026-10-21

Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions contain an XML External Entity (XXE) vulnerability caused by not disabling URI reference resolution in DTD declarations, letting attackers read arbitrary files or cause denial of service, exploit requires processing untrusted XML input.