CWE-643 · Improper Neutralization of Data within XPath Expressions (XPath Injection)

14 CVEs classified under CWE-643 (Improper Neutralization of Data within XPath Expressions (XPath Injection)). Browse by severity and year.

Top CVEs for CWE-643
CVESeverityScorePublishedSummary
CVE-2026-44962Critical9.92026-05-29Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queri…
CVE-2026-9390Critical9.12026-08-03XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concate…
CVE-2026-24343High8.82026-02-10Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7…
CVE-2024-39565High8.82024-07-10An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthe…
CVE-2020-25162High7.52022-04-14A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows…
CVE-2026-40699Medium6.52026-05-13A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed se…
CVE-2023-36433Medium6.52023-10-10Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-36429Medium6.52023-10-10Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-24922Medium6.52023-03-14Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2025-11844Medium5.42025-10-22Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browse…
CVE-2025-20218Medium4.92025-08-14A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t…
CVE-2022-43840Medium4.32025-04-14IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive…
CVE-2024-2648Medium4.32024-03-19A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the fi…
CVE-2024-2645Medium4.32024-03-19A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb…
All CVEs classified under CWE-643 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-9390Critical9.12026-08-03XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concate…
CVE-2026-44962Critical9.92026-05-29Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queri…
CVE-2026-40699Medium6.52026-05-13A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed se…
CVE-2026-24343High8.82026-02-10Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7…
CVE-2025-11844Medium5.42025-10-22Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browse…
CVE-2025-20218Medium4.92025-08-14A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker t…
CVE-2022-43840Medium4.32025-04-14IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive…
CVE-2024-39565High8.82024-07-10An Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in J-Web shipped with Juniper Networks Junos OS allows an unauthe…
CVE-2024-2648Medium4.32024-03-19A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the fi…
CVE-2024-2645Medium4.32024-03-19A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb…
CVE-2023-36433Medium6.52023-10-10Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-36429Medium6.52023-10-10Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2023-24922Medium6.52023-03-14Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2020-25162High7.52022-04-14A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows…