cve.bz

CWE-652: Improper Neutralization of Data within XQuery Expressions (XQuery Injection)

Filter

The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input.

What the weakness is: CWE-652 at MITRE. All weaknesses

Ask an AI about CWE-652

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-652: Improper Neutralization of Data within XQuery Expressions and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/652.html and https://cve.bz/cve/cwe/652?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.8CVE-2023-28676EPSS 0.6%

    A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipeline based on a Freestyle project, potentially leading to remote code execution (RCE).

  2. 6.5CVE-2023-25015EPSS 0.4%

    Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.