Critical severity9.1NVD Advisory· Published Mar 3, 2021· Updated Jun 17, 2026
CVE-2021-27931
CVE-2021-27931
Description
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:lumis:lumis_experience_platform:*:*:*:*:*:*:*:*Range: <10.0.0
- LumisXP/Lumis Experience Platformdescription
Patches
Vulnerability mechanics
References
1- github.com/sl4cky/LumisXP-XXE---POC/blob/main/poc.txtnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.