Classic xxe: .XSL file xxe: .XSL file + documet() xxe: .XSL file + <xsl:import> xxe: .XSL file + <xsl:include> xxe: