Professional 1.6.23
Summary: Burp Suite Professional 1.6.23, released 29 July 2015, adds a scan check for external service interaction and out-of-band resource load through injected XML doctype tags containing entity parameters. The scanner sends payloads and reports an issue based on any DNS or HTTP interactions that reach the Burp Collaborator server, and the release also fixes some issues.
What you should know: The check catches XML entity injection that triggers outbound DNS or HTTP traffic, so a server quietly resolving or fetching attacker-supplied references is now visible as a reported finding rather than silent behavior.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026