3Nis
Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?
I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following response from the server:
[org.xml.sax.SAXPa…
