CWE-91

153 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 27High 75Medium 45Low 6Not scored 0

CVEs per yearBy the year they were published

CVE-2020-0646
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution…
Microsoft · Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
ExploitedCritical9.8

CVE-2026-66294
XML injection in Saxy via unescaped CDATA section terminator
qcam · saxy
Low2.1
CVE-2026-66295
Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection
qcam · saxy
Low2.1
CVE-2026-66293
XML comment injection in Saxy encoder via unescaped double hyphen
qcam · saxy
Low2.1
CVE-2026-53582
OPNsense: XPATH Injection can disclose any secret in config.xml
opnsense · core
High7.1
CVE-2026-102037
Junos OS: SRX Series: An attacker causes arbitrary configuration commit when the custom URL-feed feature is used
Juniper Networks · Junos OS
Critical9.2
CVE-2026-110084
Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
Adobe · Adobe Experience Manager 6.5
High7.1
CVE-2026-102116
Kiteworks Email Protection Gateway Path Traversal
Kiteworks · Email Protection Gateway
High7.2
CVE-2026-103044
EasyTimeline should not serve image maps as application/xml
The Wikimedia Foundation · Mediawiki - EasyTimeline extension
Critical9.8
CVE-2026-76979
XML Injection vulnerability
Zohocorp · ManageEngine OpManager
High7.7
CVE-2026-65124
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability…
NVIDIA · Infrastructure Controller
Medium5.9