CWE-643 · 15 kayıt

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Bu sınıftaki CVE’ler

15 kayıt

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
39İzleyin	CVE-2026-44962İstismar yok	Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolatwebpros · plesk · CWE-643 RCE	Kritik9,9	—	%0,6	29 May 2026
36İzleyin	CVE-2026-9390İstismar yok	XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookupxml\ · \ · CWE-643 Kimlik doğrulamasız	Kritik9,1	—	%0,5	3 Ağu 2026
35İzleyin	CVE-2026-24343İstismar yok	Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressionsapache · hertzbeat · CWE-643	Yüksek8,8	—	%0,7	10 Şub 2026
31İzleyin	CVE-2020-25162İstismar yok	B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusbbraun · datamodule compactplus · CWE-643 Kimlik doğrulamasız	Yüksek7,5	—	%1,9	14 Nis 2022
30İzleyin	CVE-2024-39565İstismar yok	Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.juniper · j-web · CWE-643 Kimlik doğrulamasız	Yüksek7,7	—	%0,5	10 Tem 2024
28İzleyin	CVE-2026-40699İstismar yok	BIG-IP Configuration utility vulnerabilityf5 · big-ip access policy manager · CWE-643	Yüksek7,1	—	%0,4	13 May 2026
27İzleyin	CVE-2023-36429İstismar yok	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerabilitymicrosoft · dynamics 365 · CWE-643	Orta6,5	—	%2,0	10 Eki 2023
27İzleyin	CVE-2023-36433İstismar yok	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerabilitymicrosoft · dynamics 365 · CWE-643	Orta6,5	—	%1,9	10 Eki 2023
26İzleyin	CVE-2023-24922İstismar yok	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerabilitymicrosoft · dynamics 365 · CWE-643	Orta6,5	—	%1,5	14 Mar 2023
26İzleyin	CVE-2026-11864İstismar yok	Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.ibm · cloud pak for business automation · CWE-643	Orta6,5	—	%0,2	15 Eyl 2026
21İzleyin	CVE-2024-2648İstismar yok	Netentsec NS-ASG Application Security Gateway naccheck.php xpath injectionnetentsec · application security gateway · CWE-643 Kimlik doğrulamasız	Orta5,3	—	%0,7	19 Mar 2024
21İzleyin	CVE-2024-2645İstismar yok	Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injectionnetentsec · application security gateway · CWE-643 Kimlik doğrulamasız	Orta5,3	—	%0,7	19 Mar 2024
21İzleyin	CVE-2025-11844Kavram kanıtı	XPath Injection in Hugging Face Smolagents search_item_ctrl_f Functionhuggingface · smolagents · CWE-643 Kimlik doğrulamasız	Orta5,4	—	%0,3	22 Eki 2025
19İzleyin	CVE-2025-20218İstismar yok	Cisco Secure Firepower Management Center Software XPATH Injection Vulnerabilitycisco · secure firewall management center · CWE-643	Orta4,9	—	%0,5	14 Ağu 2025
17İzleyin	CVE-2022-43840İstismar yok	IBM Aspera Console XPath injectionibm · aspera console · CWE-643	Orta4,3	—	%0,3	14 Nis 2025

CVE-2026-44962
39İzleyin
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolat
KritikCVSS 9,9İstismar yokEPSS %1
- RCE
webpros · plesk29 May 2026
CVE-2026-9390
36İzleyin
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
KritikCVSS 9,1İstismar yokEPSS %1
- Kimlik doğrulamasız
xml\ · \3 Ağu 2026
CVE-2026-24343
35İzleyin
Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions
YüksekCVSS 8,8İstismar yokEPSS %1
apache · hertzbeat10 Şub 2026
CVE-2020-25162
31İzleyin
B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
YüksekCVSS 7,5İstismar yokEPSS %2
- Kimlik doğrulamasız
bbraun · datamodule compactplus14 Nis 2022
CVE-2024-39565
30İzleyin
Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.
YüksekCVSS 7,7İstismar yokEPSS %1
- Kimlik doğrulamasız
juniper · j-web10 Tem 2024
CVE-2026-40699
28İzleyin
BIG-IP Configuration utility vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
f5 · big-ip access policy manager13 May 2026
CVE-2023-36429
27İzleyin
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
OrtaCVSS 6,5İstismar yokEPSS %2
microsoft · dynamics 36510 Eki 2023
CVE-2023-36433
27İzleyin
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
OrtaCVSS 6,5İstismar yokEPSS %2
microsoft · dynamics 36510 Eki 2023
CVE-2023-24922
26İzleyin
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
OrtaCVSS 6,5İstismar yokEPSS %1
microsoft · dynamics 36514 Mar 2023
CVE-2026-11864
26İzleyin
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
OrtaCVSS 6,5İstismar yokEPSS %0
ibm · cloud pak for business automation15 Eyl 2026
CVE-2024-2648
21İzleyin
Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection
OrtaCVSS 5,3İstismar yokEPSS %1
- Kimlik doğrulamasız
netentsec · application security gateway19 Mar 2024
CVE-2024-2645
21İzleyin
Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injection
OrtaCVSS 5,3İstismar yokEPSS %1
- Kimlik doğrulamasız
netentsec · application security gateway19 Mar 2024
CVE-2025-11844
21İzleyin
XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
OrtaCVSS 5,4Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
huggingface · smolagents22 Eki 2025
CVE-2025-20218
19İzleyin
Cisco Secure Firepower Management Center Software XPATH Injection Vulnerability
OrtaCVSS 4,9İstismar yokEPSS %0
cisco · secure firewall management center14 Ağu 2025
CVE-2022-43840
17İzleyin
IBM Aspera Console XPath injection
OrtaCVSS 4,3İstismar yokEPSS %0
ibm · aspera console14 Nis 2025

Tüm zafiyet sınıfları