EUVD-2026-29980
Improper Neutralization of Data within XPath Expressions ('XPath Injection') (CWE-643)
GHSA-429c-h8f6-fcq6
7.1
CVSS 4.0
Share
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X
Lifecycle Timeline
5
Re-analysis Queued
May 13, 2026 - 16:22 vuln.today
cvss_changed
Severity Changed
May 13, 2026 - 16:22 NVD
MEDIUM
HIGH
CVSS changed
May 13, 2026 - 16:22 NVD
6.5 (MEDIUM)
7.1 (HIGH)
Analysis Generated
May 13, 2026 - 15:52 vuln.today
CVE Published
May 13, 2026 - 14:12 nvd
MEDIUM 6.5
DescriptionNVD
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AnalysisAI
Information disclosure in F5 BIG-IP Configuration utility allows low-privileged authenticated attackers to access sensitive information through undisclosed pages, affecting the confidentiality of administrative data without requiring user interaction or privileged credentials beyond standard authentication.
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).