XPath Injection mirrors SQL Injection but targets XML databases. Unlike SQL, XPath has no ACLs — a successful injection can return the entire XML document. … More XPath Injection Attacks: SQL Injection’s XML Counterpart