{"id":"CVE-2026-112198","published":"2026-10-28T11:17:15.220","lastModified":"2026-10-28T14:43:13.110","description":"XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}