CVE-2021-27931

PoC —

CVSS 3.1

9.1 critical

EPSS

18%p97

Published

Mar 3, 2021 (Mar 3, 2021)

Modified

Jun 17, 2026

Description

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

Vendors: lumis
Products: lumis experience platform
Weakness: CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (18.1%)

In the news0 stories

No ingested article mentions this CVE yet.