CVE Watch5 ago 2026

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath exp

CVSS

9.1

Crítico

EPSS

0.5%

p42

KEV

—

Exploit Today

0-100

Publicado: 3 ago 2026 · Última mod.: 5 ago 2026 · CWE-643 · CWE-1287

EPSS · 30d

0.3%EPSS · 30 días0.5%

2026-09-222026-10-20

Descripción técnica

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-583954.3 MED

27.9%

——8OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.6d CVE-2026-535827.1 ALT

53.3%

——16OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.5d CVE-2026-1108577.5 ALT

34.6%

——10GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when git permits the ext transport, while merge_base and IndexFile.move also accept unguarded option injection.6d CVE-2026-978017.5 ALT

48.2%

——14Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.8d CVE-2026-960448.8 ALT

53.5%

——16No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.5d CVE-2026-780163.1 BAJ

4.7%

——1Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information tampering.8d