Verify XML parsers disable external entities
An XML parser is XXE-safe only if external entities and DTDs are explicitly disabled at construction.
Tag: xxe
XXE through SVG and Office file uploads
Any feature that parses SVG, DOCX, or XLSX server side is an XML parser you can feed an external entity to.
Blind XXE exfiltration with external parameter entities
When inline DTDs are blocked and there is no output, an external DTD with parameter entities exfiltrates files over your own channel.