xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

xcat

XCat XCat은 블라인드 XPath 인젝션 취약점을 악용하고 조사하기 위한 명령줄 도구입니다. 전체 참고 문서는 여기에서 읽을 수 있습니다: https://xcat.readthedocs.io/en/latest/ 다양한 기능을 지원합니다: 인젝션 자동 선택 xcat injections 실행 시 목록 확인 가능 XPath 파서의 버전과 기능을 감지하고 가장 빠른 검색 방법 선택 내장 out-of-bound HTTP 서버 XXE 공격 자동화 OOB HTTP 요청을 사용해 검색 속도를 크게 향상 사용자 지정 요청 헤더 및 본문 내...

CVE-2024-45409

Ruby-SAML / GitLab 인증 우회 CVE-2024-45409 익스플로잇 이 스크립트는 CVE-2024-45409를 익스플로잇합니다. 이 취약점은 IDP가 발급한 서명된 SAML 문서에 접근할 수 있는 인증되지 않은 공격자가 SAML 응답/어설션을 위조하여 GitLab의 모든 사용자로 액세스할 수 있게 합니다. 다음 GitLab CE/EE 버전은 모두 취약합니다: 16.11.10 17.0.0 17.0.8 17.0.0 17.1.8 17.0.0 17.2.7 17.0.0 17.3.3 이 익스플로잇은 수정된 어설션의...

CVE-2024-36401-poc

CVE-2024-36401 — GeoServer OGC XPath 인젝션 RCE OGC 필터 valueReference 매개변수 인젝션XPath/JXPath 평가을 통한 GeoServer 무인증 원격 코드 실행RCE 익스플로잇. 면책 고지: 이 도구는 승인된 침투 테스트 및 보안 연구 목적으로만 제작되었습니다. 소유하지 않았거나 명시적인 서면 테스트 승인을 받지 않은 시스템에는 사용하지 마십시오. 작성자는 이 도구로 인한 오용 또는 피해에 대해 어떠한 책임도 지지 않습니다. 목차 개요 영향을 받는 버전 기술 세부 정보 요구 사...

Linux Distros Unpatched Vulnerability : CVE-2026-103044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects...

CVE-2025-11844-smolagents

🔐 Smolagents XPath Injection Simulation Framework CVE-2025-11844 An educational auditing sandbox and dynamic proof-of-concept scanner demonstrating the XPath Injection vulnerability found within Hugging Face's smolagents library up to version 1.2.0. 🔍 Vulnerability Profile Metric| Details ---|---...

CVE-2026-103044

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

UBUNTU-CVE-2026-103044

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044 EasyTimeline should not serve image maps as application/xml

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-103044

The MediaWiki - EasyTimeline extension is vulnerable to an XML injection (specifically blind XPath injection ) due to the improper serving of image map files as application/xml data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potenti...

PT-2026-102932

Name of the Vulnerable Software and Affected Versions Mediawiki - EasyTimeline extension versions prior to 1.46.1 Mediawiki - EasyTimeline extension version 1.45.5 Mediawiki - EasyTimeline extension version 1.43.10 Description An XML injection issue, also known as blind XPath injection, exists in...

CVE-2026-103044: XML Injection (aka Blind XPath Injection)

XML injection aka blind XPath injection vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10...

xpath

xpath 승인된 보안 테스트를 위한 고급 XPath 인젝션 스캐너. Chokri Hammediblue0x1 제작 · MIT 라이선스 개요 xpath는 Nim으로 작성된 빠르고 다양한 기법을 지원하는 XPath 인젝션 스캐너입니다. 실제 XML 기반 애플리케이션에서의 실용적인 탐지, 응답 비교, 가시적 추출, 블라인드 추출, 페이로드 커버리지에 중점을 둡니다. Nim 표준 라이브러리 외에 외부 런타임 의존성이 없습니다. 기능 영역| 지원 ---|--- 탐지| 오류 기반, 불리언 기반 블라인드, 시간 기반 블라인드, 인증 우회,...

CVE-2026-76979: XML Injection (aka Blind XPath Injection)

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature...

CVE-2026-65124: XML Injection (aka Blind XPath Injection)

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service...

CVE-2026-11864

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

EUVD-2026-78901

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-11864 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-11864

IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 IF 001, 25.0.0 through 25.0.0 IF 005, 24.0.1 through 24.0.1 IF 008, and 24.0.0 through 24.0.0 IF 009 are affected by an XPath injection vulnerability. An authenticated attacker can use it to exfiltrate sensitive application data...