CWE-643
19 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 19Published CVEs19 of them scored
- 9Last 12 monthspublished in the last year
- 2Critical6 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-114442
Apache HertzBeat: incomplete XPath expression validation in aliasFields
Apache Software Foundation · Apache HertzBeat
Medium6.5 - CVE-2026-93434
Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
WatchGuard · Fireware OS
High8.7 - CVE-2026-58395
OPNsense: XPath injection in MVC safe-delete
opnsense · core
Medium4.3 - CVE-2026-53582
OPNsense: XPATH Injection can disclose any secret in config.xml
opnsense · core
High7.1 - CVE-2026-11864
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
IBM · Cloud Pak for Business Automation
Medium6.5 - CVE-2026-9390
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
TIMLEGGE · XML::Sig
Critical9.1 - CVE-2026-44962
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath…
WebPros · Plesk
Critical9.9 - CVE-2026-40699
BIG-IP Configuration utility vulnerability
F5 · BIG-IP
High7.1 - CVE-2026-24343
Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
Apache Software Foundation · Apache HertzBeat
High8.8 - CVE-2025-11844
XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
huggingface · huggingface/smolagents
Medium5.4