Client-side XPath injection (DOM-based)
Summary: DOM-based XPath injection occurs when a client-side script reads controllable data, such as from the URL, and incorporates it into an XPath query. An attacker can construct a URL that, when visited by another user, causes an arbitrary XPath query to execute and different data to be retrieved and processed by the application.
Key Takeaway: The consequence depends on what the query results feed: PortSwigger notes it may be possible to subvert the application's logic or cause unintended actions on behalf of the user, and Burp's static analysis can flag cases that are not actually exploitable, so a finding without dynamic evidence needs code review.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026