added multi_xml vulnerability (I missed it somehow)