xpath

xpath 승인된 보안 테스트를 위한 고급 XPath 인젝션 스캐너. Chokri Hammediblue0x1 제작 · MIT 라이선스 개요 xpath는 Nim으로 작성된 빠르고 다양한 기법을 지원하는 XPath 인젝션 스캐너입니다. 실제 XML 기반 애플리케이션에서의 실용적인 탐지, 응답 비교, 가시적 추출, 블라인드 추출, 페이로드 커버리지에 중점을 둡니다. Nim 표준 라이브러리 외에 외부 런타임 의존성이 없습니다. 기능...

xcat

XCat XCat — это инструмент командной строки для эксплуатации и исследования уязвимостей слепой XPath-инъекции. Полную документацию читайте здесь: https://xcat.readthedocs.io/en/latest/ Поддерживается большое количество возможностей: Автоматический выбор инъекций выполните xcat injections для спис...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

CVE-2024-36401-poc

CVE-2024-36401 — GeoServer OGC XPath 인젝션 RCE OGC 필터 valueReference 매개변수 인젝션XPath/JXPath 평가을 통한 GeoServer 무인증 원격 코드 실행RCE 익스플로잇. 면책 고지: 이 도구는 승인된 침투 테스트 및 보안 연구 목적으로만 제작되었습니다. 소유하지 않았거나 명시적인 서면 테스트 승인을 받지 않은 시스템에는 사용하지 마십시오. 작성자는 이 도구로 인한 오용 또는 피해에 대해 어떠한 책임도 지지 않습니다. 목차 개요 영향을 받는 버전 기술 세부 정보 요구 사...

CVE-2025-11844-smolagents

🔐 Среда моделирования XPath-инъекции Smolagents CVE-2025-11844 Образовательная аудиторская песочница и динамический сканер proof-of-concept, демонстрирующие уязвимость XPath-инъекции, обнаруженную в библиотеке smolagents от Hugging Face до версии 1.2.0. 🔍 Профиль уязвимости...

CVE-2024-45409

Эксплойт обхода аутентификации Ruby-SAML / GitLab CVE-2024-45409 Этот скрипт эксплуатирует CVE-2024-45409, который позволяет неаутентифицированному атакующему, имеющему доступ к любому подписанному SAML-документу, выданному IDP, подделать SAML Response/Assertion и получить доступ к GitLab в...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

EUVD-2026-52269

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...

CVE-2026-9390

CVE-2026-9390 affects XML::Sig (Perl) versions before 0.71. The issue arises when verify()/_get_signed_xml() build XPath expressions by concatenating SignedInfo/Reference/@URI from the document without escaping or enforcing NCName rules. A URI containing a single quote can terminate the string li...

PYSEC-2026-1930 Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function

Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...

PT-2026-56190

A stored XPATH injection vulnerability exists in opnsense's trust module. Any user if given just System: CA Manager permissions can use a bool side channel/oracle to slowly leak any secret in config.xml character by character. the injection point is in the refid field of a ca object. Write-up for...

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions 'XPath Injection' through the XPath Transform process. An attacker can cause the application to become unresponsive or crash by sending specially crafted messages that exploit thi...

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions 'XPath Injection' through the XPath Transform process. An attacker can cause the application to become unresponsive or crash by sending specially crafted messages that exploit thi...

CVE-2026-44962

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the...

CVE-2026-44962

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the...

CVE-2026-44962

Plesk: XPath injection in the APS Application Catalog search allows authenticated, low-privileged users to cause local privilege escalation by interpolating unsanitized input into XPath queries. Affected: Plesk APS Catalog search component. Root cause: inadequate input sanitization for XPath. Imp...

CVE-2026-44962

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the...

CVE-2026-44962

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the...