XPath

XPath is a query language for selecting nodes from XML documents, often used by applications that store data or credentials in XML. When user input is concatenated into an XPath query, attackers can inject their own syntax to bypass authentication or read the entire document, much like SQL injection. Since XPath has no access controls of its own, parameterization and input validation are the key defenses.