On this page

CWE-91: XML Injection (aka Blind XPath Injection)

Weakness Summary

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

  • Canonical source: MITRE CWE-91 (opens in a new tab)
  • Published Atomicorp CVE observations: 3
  • Distinct affected products in those observations: 3
  • Active Atomicorp rules associated with this weakness: 15

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2015-6970Bosch Security Systems Dinion NBN-498 - Web Interface XML Injectionnbn-498 dinion2x day/night ip cameras firmwareAttack Blocked by Atomicorp390726 , 392301 , 392647 , 392648
CVE-2022-25356Alt-n/MDaemon Security Gateway <=8.5.0 - XML InjectionsecuritygatewayAttack Blocked by Atomicorp390716
CVE-2026-89247WWBN AVideo XML Injection via plugin/AD_Server/VMAP.phpAVideoAttack Blocked by Atomicorp330791 , 340152 , 341256 , 344360 , 344370 , 344372 , 344373 , 347009 , 350147 , 380018

Associated Atomicorp WAF Rules

RuleStatusBehavior
330791Activedisruptive (deny)
340152Activedisruptive (deny)
341256Activedisruptive (deny)
344360Activedisruptive (deny)
344370Activedisruptive (deny)
344372Activedisruptive (deny)
344373Activedisruptive (deny)
347009Activedisruptive (deny)
350147Activedisruptive (deny)
380018Activedisruptive (deny)
390716Activedisruptive (deny)
390726Activedisruptive (deny)
392301Activedisruptive (deny)
392647Activedisruptive (deny)
392648Activedisruptive (deny)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-250 (opens in a new tab) , CAPEC-83 (opens in a new tab)