XML External Entity (XXE)

How a single <!DOCTYPE> line turns an XML parser into a file-read, SSRF and DoS primitive. Every variant: classic file read, SSRF via XXE, parameter-entity OOB exfil, billion-laughs DoS, XInclude injection, plus XXE hiding inside SAML, SOAP, DOCX, SVG, RSS and PDF. Real incidents (Facebook, Uber, Cisco), per-language defences (Python/Java/Node/PHP/.NET/Go), and the tester checklist.