Threats Tagged 'cwe-643'
View all threats tagged with 'cwe-643'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cwe-643'
Click on any threat for detailed analysis and mitigation recommendations
0 XML::Sig versions before 0.71 for Perl are vulnerable to XPath injection due to improper neutralization of data within XPath expressions. The vulnerability arises because the verify() and _get_signed_xml() functions build XPath queries by concatenating unescaped URI values from the document, allowing an attacker to inject arbitrary XPath operators. This can cause the digest verification process to select unintended XML nodes, potentially compromising the integrity verification of signed XML documents. Join the discussion | CVE Database V5 | 08/03/2026, 13:09:40 UTC Added: 08/03/2026, 13:33:39 UTC |
0 Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation. Join the discussion | CVE Database V5 | 05/29/2026, 15:41:23 UTC Added: 05/29/2026, 16:18:47 UTC |
0 A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Join the discussion | CVE Database V5 | 05/13/2026, 14:12:29 UTC Added: 05/13/2026, 15:21:49 UTC |
Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. Join the discussion | CVE Database V5 | 02/10/2026, 09:28:52 UTC Added: 02/10/2026, 09:46:22 UTC |
0 CVE-2025-11844 is an XPath injection vulnerability in Hugging Face's Smolagents version 1.20.0, specifically in the search_item_ctrl_f function. The vulnerability arises from unsanitized user input being directly concatenated into XPath queries, allowing attackers to manipulate query logic. Exploitation can bypass search filters, access unintended DOM elements, and disrupt automated web tasks, potentially leading to information disclosure and manipulation of AI agent interactions. The flaw is fixed in version 1.22.0. The CVSS score is 5.4 (medium severity), with no known exploits in the wild. Join the discussion | CVE Database V5 | 10/22/2025, 13:13:55 UTC Added: 10/22/2025, 13:31:15 UTC |
Showing 1 to 5 of 5 results