Skip to content
OpenAdvisories

Weakness (CWE)

CWE-643: Improper Neutralization of Data within XPath Expressions

Base Incomplete

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input.

How to prevent it (2 mitigations)

  1. Implementation

    Use parameterized XPath queries (e.g. using XQuery). This will help ensure separation between data plane and control plane.

  2. Implementation

    Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XPath queries is safe in that context.

Source: MITRE CWE-643

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-114442

    Apache HertzBeat: incomplete XPath expression validation in aliasFields

    Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.…

    Apache Software Foundation Apache HertzBeat
  • Medium 4.3
    CVE-2026-58395

    OPNsense: XPath injection in MVC safe-delete

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over…

    opnsense core
  • Medium 6.5
    CVE-2026-11864

    Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

    IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could…

    IBM Cloud Pak for Business Automation
  • Medium 6.5
    CVE-2026-40699

    BIG-IP Configuration utility vulnerability

    A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are…

    F5 BIG-IP Network devices
  • Medium 5.4
    CVE-2025-11844 Public exploit

    XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

    Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the …

    huggingface huggingface/smolagents smolagents PyPI
  • Medium 4.9
    CVE-2025-20218

    Cisco Secure Firepower Management Center Software XPATH Injection Vulnerability

    A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to retrieve sensitive information from an affected device. This vulnerability is due to insufficient …

    Cisco Cisco Firepower Management Center Network devices
  • Medium 4.3
    CVE-2022-43840

    IBM Aspera Console XPath injection

    IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.

    IBM Aspera Console
  • Medium 6.8
    CVE-2024-8955

    SSRF in composiohq/composio

    A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS acti…

    ComposioHQ composiohq/composio composio-core PyPI
  • Medium 4.3
    CVE-2024-2648

    Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection

    A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of …

    Netentsec NS-ASG Application Security Gateway
  • Medium 4.3
    CVE-2024-2645

    Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injection

    A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of …

    Netentsec NS-ASG Application Security Gateway
  • Medium 6.5
    CVE-2023-36429

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

    Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 Microsoft Dynamics 365 (on-premises) version 9.0
  • Medium 6.5
    CVE-2023-36433

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

    Microsoft Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1
  • Medium 6.5
    CVE-2023-24922

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

    Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

    Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 Microsoft Dynamics 365 (on-premises) version 9.0