/alerttags/wstg-v42-inpv-07/ Recent content in WSTG-V42-INPV-07 on ZAP Hugo en-us /docs/alerts/90023/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/alerts/90023/ <p>This technique takes advantage of a feature of XML to build documents dynamically at the time of processing. An XML message can either provide data explicitly or by pointing to an URI where the data exists. In the attack technique, external entities may replace the entity value with malicious data, alternate referrals or may compromise the security of the data the server/XML application has access to. Attackers may also use External Entities to have the web services server download malicious code or content to the server for use in secondary or follow on attacks.</p>