Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability.
Quest Foglight for Databases AbstractParser XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AbstractParser class. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-28
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Quest
- Product
- Foglight for Databases
- CVSS v3.0
- 7.2 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
- Weakness
- CWE-611
- NVD status
- Received
Why it ranks 31 (Notable)
- CVSS v3.0 7.2 high
- Covered by 2 independent sources
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-92185 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.