Common Weakness Enumeration

    CWE Definition / CWE-91

    CWE-91: XML Injection (aka Blind XPath Injection)

    The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

    Published:19 Jul 2006
    Organization:MITRE
    Modified:30 Apr 2026

    Related Weakness

    CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

    CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')