What it is
XXE occurs when an application parses attacker-controlled XML with external entity resolution enabled. Defined entities can reference local files or remote URLs, so the parser returns file contents or makes server-side requests on the attacker's behalf.
How to test for it
Submit XML that defines an external entity pointing at a local file or a URL you control, and check whether the file contents appear in the response or an inbound request arrives. Use out-of-band and parameter-entity techniques for blind XXE.
How to prevent it
Disable DOCTYPE declarations and external entity resolution in the XML parser — the configuration varies per library but the goal is the same. Prefer less complex data formats like JSON where XML isn't required.