CVE-2018-8819

CVE-2018-8819 describes an XML External Entity (XXE) vulnerability in Automated Logic Corporation (ALC) WebCTRL versions 6.0, 6.1, and 6.5. An unauthenticated attacker can exploit a weakly configured XML parser by injecting malicious input via the "X-Wap-Profile" HTTP header, leading to the disclosure of full file contents from the underlying web server operating system. This vulnerability has a high CVSS score of 7.5, indicating a critical risk due to its network-based attack vector, low complexity, and high impact on confidentiality. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, with one Reddit post detailing its discovery.