Description
N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
Low
User Interaction
None
Confidentiality (Vulnerable System)
High
Integrity (Vulnerable System)
None
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
High
Integrity (Subsequent System)
Low
Availability (Subsequent System)
Low
Affected products
- N-able / N-central0 – 2025.4
Exploits & proofs of concept
- nucleiN-central - XML External Entities Injectionby DhiyaneshDK,horizon3ai
Updated 38m ago · 8 sources