Client-side XPath injection (stored DOM-based)
Summary: PortSwigger describes stored DOM-based XPath injection as a flaw where user input is stored and later embedded into a response within a part of the DOM that a client-side script processes unsafely, letting an attacker control data that gets incorporated into an XPath query. An attacker may construct a URL that, if visited by another application user, causes an arbitrary XPath query to execute, retrieving different data and potentially subverting the application's logic or causing unintended actions on the user's behalf.
Why it matters: The payload sits in stored data and fires when another user loads the page, so the person who triggers the arbitrary XPath query is not the person who planted it. PortSwigger also notes its static analysis can flag false positives that are not actually exploitable, so a scanner finding here needs code and execution-path review before you treat it as real.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026