Exploitation: XML External Entity (XXE) Injection
depthsecurity.com