BI Web Services in SAS Web Infrastructure Platform prior to 9.4M6 allows XXE.
sas web_infrastructure_platform 9.4
sas web_infrastructure_platform