CWE-643

19 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 2High 6Medium 11Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-114442
Apache HertzBeat: incomplete XPath expression validation in aliasFields
Apache Software Foundation · Apache HertzBeat
Medium6.5
CVE-2026-93434
Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets
WatchGuard · Fireware OS
High8.7
CVE-2026-58395
OPNsense: XPath injection in MVC safe-delete
opnsense · core
Medium4.3
CVE-2026-53582
OPNsense: XPATH Injection can disclose any secret in config.xml
opnsense · core
High7.1
CVE-2026-11864
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
IBM · Cloud Pak for Business Automation
Medium6.5
CVE-2026-9390
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
TIMLEGGE · XML::Sig
Critical9.1
CVE-2026-44962
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath…
WebPros · Plesk
Critical9.9
CVE-2026-40699
BIG-IP Configuration utility vulnerability
F5 · BIG-IP
High7.1
CVE-2026-24343
Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
Apache Software Foundation · Apache HertzBeat
High8.8
CVE-2025-11844
XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
huggingface · huggingface/smolagents
Medium5.4