CWE-643
Improper Neutralization of Data within XPath Expressions ('XPath Injection')
Monthly
Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document node is validated by injecting XPath operators through the SignedInfo/Reference/@URI attribute. Because verify() and _get_signed_xml() concatenate the attacker-controlled URI into an XPath expression without escaping or NCName validation, a single quote breaks out of the string literal and lets the injected expression decide which element is digest-checked - undermining the integrity guarantee of any XML Signature the library verifies. No public exploit has been identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch exists in release 0.71.
Local privilege escalation in Plesk's APS Application Catalog allows an authenticated low-privileged user to execute arbitrary operating system commands by injecting malicious XPath syntax into the catalog search functionality. The flaw carries a critical CVSS 3.1 score of 9.9 due to scope change and full CIA impact, and no public exploit identified at time of analysis. The advisory was disclosed via HackerOne and acknowledged in a Plesk support article, but EPSS and KEV signals are not provided in the available intelligence.
Information disclosure in F5 BIG-IP Configuration utility allows low-privileged authenticated attackers to access sensitive information through undisclosed pages, affecting the confidentiality of administrative data without requiring user interaction or privileged credentials beyond standard authentication.
Apache HertzBeat versions 1.7.1 through 1.8.0 contain an XPath injection vulnerability that allows authenticated attackers to manipulate XPath queries and potentially extract or modify sensitive data. An attacker with valid credentials can exploit this flaw to bypass access controls and execute arbitrary XPath expressions against the application's XML data stores. Affected users should upgrade to version 1.8.0 immediately as no patch is currently available for earlier versions.
Authenticated OPNsense users who hold at least one affected module privilege can supply a crafted safe-delete token that is interpolated into an XPath query over config.xml, letting them read configuration metadata from modules they are not authorized to access. The flaw, tracked as CVE-2026-58395, affects OPNsense releases prior to 26.1.11 and yields a substring-presence oracle that leaks configuration item names, descriptions, reference paths, and UUIDs, though it cannot modify configuration or delete data. It is a read-only information-disclosure issue rated 4.3 medium; no public exploit code identified at time of analysis, and CISA KEV does not list it.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web browser's Ctrl-F style search (search_item_ctrl_f) rewrite the underlying XPath query, bypassing intended search filters and pulling in unintended DOM elements. The flaw is reachable without authentication (CVSS PR:N) but requires the agent or user to trigger the search with attacker-influenced text (UI:R), so it is not passively exploitable; impact is bounded to information disclosure from the queried page, manipulation of agent search results, and disruption of automation workflows rather than code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.28% (19th percentile), making this a moderate, situational risk rather than a high-priority emergency.
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to retrieve sensitive information from an. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated, network-based attacker to. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required.
Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document node is validated by injecting XPath operators through the SignedInfo/Reference/@URI attribute. Because verify() and _get_signed_xml() concatenate the attacker-controlled URI into an XPath expression without escaping or NCName validation, a single quote breaks out of the string literal and lets the injected expression decide which element is digest-checked - undermining the integrity guarantee of any XML Signature the library verifies. No public exploit has been identified at time of analysis, and the flaw is not on CISA KEV; a vendor patch exists in release 0.71.
Local privilege escalation in Plesk's APS Application Catalog allows an authenticated low-privileged user to execute arbitrary operating system commands by injecting malicious XPath syntax into the catalog search functionality. The flaw carries a critical CVSS 3.1 score of 9.9 due to scope change and full CIA impact, and no public exploit identified at time of analysis. The advisory was disclosed via HackerOne and acknowledged in a Plesk support article, but EPSS and KEV signals are not provided in the available intelligence.
Information disclosure in F5 BIG-IP Configuration utility allows low-privileged authenticated attackers to access sensitive information through undisclosed pages, affecting the confidentiality of administrative data without requiring user interaction or privileged credentials beyond standard authentication.
Apache HertzBeat versions 1.7.1 through 1.8.0 contain an XPath injection vulnerability that allows authenticated attackers to manipulate XPath queries and potentially extract or modify sensitive data. An attacker with valid credentials can exploit this flaw to bypass access controls and execute arbitrary XPath expressions against the application's XML data stores. Affected users should upgrade to version 1.8.0 immediately as no patch is currently available for earlier versions.
Authenticated OPNsense users who hold at least one affected module privilege can supply a crafted safe-delete token that is interpolated into an XPath query over config.xml, letting them read configuration metadata from modules they are not authorized to access. The flaw, tracked as CVE-2026-58395, affects OPNsense releases prior to 26.1.11 and yields a substring-presence oracle that leaks configuration item names, descriptions, reference paths, and UUIDs, though it cannot modify configuration or delete data. It is a read-only information-disclosure issue rated 4.3 medium; no public exploit code identified at time of analysis, and CISA KEV does not list it.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
XPath injection in Hugging Face Smolagents 1.20.0 lets an attacker who can influence the text passed to the vision web browser's Ctrl-F style search (search_item_ctrl_f) rewrite the underlying XPath query, bypassing intended search filters and pulling in unintended DOM elements. The flaw is reachable without authentication (CVSS PR:N) but requires the agent or user to trigger the search with attacker-influenced text (UI:R), so it is not passively exploitable; impact is bounded to information disclosure from the queried page, manipulation of agent search results, and disruption of automation workflows rather than code execution. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.28% (19th percentile), making this a moderate, situational risk rather than a high-priority emergency.
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to retrieve sensitive information from an. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthenticated, network-based attacker to. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, no authentication required.