CVE-2020-25020: Mpxj

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

Affected products

• Mpxj Mpxj: up to and including 8.1.3
• Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 16.1 only; version 16.2 only; version 18.8 only; version 19.12 only; version 20.12 only

Published 2020-08-29. Last modified 2026-06-17.