xxe 4 XXE Injection via Envelope Import Leads to Arbitrary File Read | Foldmark Jun 9, 2026 XXE Injection – Arbitrary File Disclosure via XML Import | Holloway May 13, 2026 XInclude Injection to Arbitrary File Read | Tanuki May 12, 2026 XML External Entity (XXE) via Deck Import Feature | Tanuki May 6, 2026