Improper Neutralization of Data within XPath Expressions
CWE-643
The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.7.
How this weakness is prevented
- Implementation: Use parameterized XPath queries (e.g. using XQuery). This will help ensure separation between data plane and control plane.
- Implementation: Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XPath queries is safe in that context.
Latest Improper Neutralization of Data within XPath Expressions vulnerabilities
- 8.7 High severity
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows…
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
- 7.1 High severity
core: XML Injection
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNs
- 9.1 Critical severity
XML::Sig: Improper Neutralization of Data within XPath Expressions
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither
- 9.9 Critical severity
Plesk: Improper Neutralization of Data within XPath Expressions
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrar
- 8.8 High severity
Apache HertzBeat: Improper Neutralization of Data within XPath Expressions
Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.
- 8.8 High severity
Junos OS: Improper Neutralization of Data within XPath Expressions
An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated, network-based attacker to execute remote commands on the target device. While an administra