CVE-2026-24343

Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue.

Scoring

CVSS base score

0

EPSS probability

0.72%

CWE

CWE-643

Published

2026-02-10

Last modified

2026-03-12

Affected products

• Apache Software Foundation Apache HertzBeat

Weakness type

• CWE-643

Related vulnerabilities

• CVE-2026-9390 — XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
• CVE-2026-44962 — Plesk contains an XPath injection vulnerability in the APS Application Catalog search...
• CVE-2026-40699 — BIG-IP Configuration utility vulnerability
• CVE-2025-11844 — XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function
• CVE-2025-20218 — Cisco Secure Firepower Management Center Software XPATH Injection Vulnerability
• CVE-2022-43840 — IBM Aspera Console XPath injection
• CVE-2024-39565 — Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device.
• CVE-2024-2648 — Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection

Markdown version · Browse all CVEs