When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of…
CVSS 4.0HIGH 8.7·Network·No auth·No interaction·EPSS 0.00409·Published 2026-09-11·Fixed in 4.7.2CWE-611
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.
CVSS 4.0HIGH 8.8·Network·No auth·No interaction·EPSS 0.00437·Published 2026-09-11·Fixed in 4.7.2CWE-611
NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected syste…
CVSS 4.0HIGH 7.2·Network·Low privileges·No interaction·EPSS 0.0045·Published 2026-09-11·Fixed in 4.7.2CWE-89
