description: CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
problem types: XML injection (XXE)
affected:
{
vendor: n/a
product: CandidATS
versions:
version: 3.0.0, status: affected
}