cyber security Xpath Injection Attack XPath Injection is an cyber attack used to fetch sensitive data (stored in XML format) from a website, by injecting malicious XPath queries. This attack works for applications that leverage user-supplied information to construct XPath queries.