The issue affects the /webtools/control/xmlrpc endpoint in the OFBiz XML-RPC event handler, making it vulnerable to External Entity Injection. This is achieved by passing DOCTYPE declarations with executable payloads, which can disclose the contents of files in the filesystem. Additionally, it can be used to probe for open network ports and determine whether a file exists or not based on returned error messages.