CVE-2021-27931: Lumis Experience Platform

Critical severity, CVSS 9.1. EPSS: 18.1% chance of exploitation in the next 30 days.

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.

Affected products

• Lumis Lumis Experience Platform: before 10.0.0 (fixed in 10.0.0)

Published 2021-03-03. Last modified 2026-06-17.