CWE-91 XML注入(XPath盲注) 类弱点 72 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-91即XML注入（又称盲XPath注入），属于输入验证缺陷。攻击者通过注入恶意XML字符或结构，篡改XML语法与内容，从而绕过逻辑控制或执行非预期命令。开发者应严格对用户输入进行白名单验证，对特殊字符如<、>、&等进行实体编码或转义，并使用安全的XML解析库，避免直接拼接用户数据，以阻断注入路径。
| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-103044 | EasyTimeline 图像地图MIME类型错误 — Mediawiki - EasyTimeline extension | - | - | 2026-09-29 |
| CVE-2026-76979 | XML 注入漏洞 — ManageEngine OpManager | 7.7 | High | 2026-09-23 |
| CVE-2026-65124 | NVIDIA Linux Infrastructure Controller XML注入漏洞 — Infrastructure Controller | 5.9 | Medium | 2026-09-22 |
| CVE-2026-89247 | WWBN AVideo 输入验证错误漏洞 — AVideo | 6.1 | Medium | 2026-09-11 |
| CVE-2026-2310 | IBM webMethods Integration Server 输入验证错误漏洞 — webMethods Integration Server | 7.8 | High | 2026-09-10 |
| CVE-2026-83618 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-83617 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-83616 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-83609 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-83608 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-83607 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-83605 | xmldom 输入验证错误漏洞 — xmldom | 8.7 | High | 2026-09-01 |
| CVE-2026-48590 | Joshua Nussbaum XML Builder 输入验证错误漏洞 — xml_builder | 2.1 | Low | 2026-08-21 |
| CVE-2026-47080 | Joshua Nussbaum XML Builder 输入验证错误漏洞 — xml_builder | 2.1 | Low | 2026-08-21 |
| CVE-2026-24329 | Redhat wildfly core 输入验证错误漏洞 — Red Hat Fuse 7 | 4.9 | Medium | 2026-08-11 |
| CVE-2026-59728 | withastro astro 输入验证错误漏洞 — astro | 4.3 | Medium | 2026-07-27 |
| CVE-2026-15037 | Qt 输入验证错误漏洞 — Qt | 2.9 | Low | 2026-07-23 |
| CVE-2026-55789 | logto-io logto 输入验证错误漏洞 — logto | 8.5 | High | 2026-07-10 |
| CVE-2026-46490 | samlify 安全漏洞 — samlify | - | - | 2026-06-08 |
| CVE-2026-47273 | pam_usb 安全漏洞 — pam_usb | 6.5 | Medium | 2026-05-27 |
| CVE-2026-44664 | fast-xml-parser 安全漏洞 — fast-xml-builder | 6.1 | Medium | 2026-05-13 |
| CVE-2026-44665 | fast-xml-builder 安全漏洞 — fast-xml-builder | 6.1 | Medium | 2026-05-13 |
| CVE-2026-41650 | fast-xml-parser 安全漏洞 — fast-xml-parser | 6.1 | Medium | 2026-05-07 |
| CVE-2026-41675 | XMLDOM 安全漏洞 — xmldom | 8.7 | High | 2026-05-07 |
| CVE-2026-41674 | XMLDOM 安全漏洞 — xmldom | 8.7 | High | 2026-05-07 |
| CVE-2026-41672 | XMLDOM 安全漏洞 — xmldom | 8.7 | High | 2026-05-07 |
| CVE-2026-27693 | Traccar 安全漏洞 — traccar | 5.4 | Medium | 2026-05-05 |
| CVE-2026-32870 | Kirby 安全漏洞 — kirby | 7.1AI | High AI | 2026-04-24 |
| CVE-2026-34601 | XMLDOM 安全漏洞 — xmldom | 7.5 | High | 2026-04-02 |
| CVE-2026-28770 | International Datacasting SFX Series SuperFlex Satellite Receiver Web management interface 安全漏洞 — SFX Series SuperFlex Satellite Receiver Web management interface | 5.4AI | Medium AI | 2026-03-04 |
CWE-91（XML注入(XPath盲注)） 是常见的弱点类别，本平台收录该类弱点关联的 72 条 CVE 漏洞。