CWE-643: Improper Neutralization of Data within XPath Expressions (XPath Injection)
Filter
The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input.
What the weakness is: CWE-643 at MITRE. OWASP Top 10: A05:2025 Injection
Ask an AI about CWE-643
Show the prompt
Explain CWE-643: Improper Neutralization of Data within XPath Expressions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/643.html and https://cve.bz/cve/cwe/643?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- –CVE-2026-114442EPSS 0.2%
Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressi…
- 8.7CVE-2026-93434EPSS 0.5%
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially…
- 4.3CVE-2026-58395EPSS 0.4%
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an X…
- 7.1CVE-2026-53582EPSS 0.7%
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsens…
- 6.5CVE-2026-11864EPSS 0.4%
IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulner…
- 9.1CVE-2026-9390EPSS 0.5%
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified…
- 9.9CVE-2026-44962EPSS 0.7%
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged use…
- 7.1CVE-2026-40699EPSS 0.3%
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technica…
- 8.8CVE-2026-24343EPSS 0.8%
Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes …
- 5.4CVE-2025-11844EPSS 0.3%
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supp…
- 4.9CVE-2025-20218EPSS 0.5%
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability …
- 4.3CVE-2022-43840EPSS 0.3%
IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.
- 7.7CVE-2024-39565EPSS 0.5%
An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated, network-based attacker to execute remote commands on the target device…
- 5.3CVE-2024-2648EPSS 0.7%
A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to imprope…
- 5.3CVE-2024-2645EPSS 0.7%
A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to imprope…
- 6.5CVE-2023-36433EPSS 2.2%
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
- 6.5CVE-2023-36429EPSS 2.2%
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
- 6.5CVE-2023-24922EPSS 1.5%
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
- 7.5CVE-2020-25162EPSS 1.9%
A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows unauthenticated remote attackers to access sensitive information and escalate pr…