🚨 CVE-2023-42346
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.