CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

No d...

CVE-2022-50807

This CVE entry is rejected/not used and does not represent an active vulnerability entry.

EUVD-2025-35361

Hugging Face Smolagents XPath injection vulnerability in the searchitemctrlf function...