How to: XPath Injection
https://book.hacktricks.xyz/pentesting-web/xpath-injection
# XPath Injection is an attack technique used to exploit applications that construct XPath (XML Path Language) queries from user-supplied input to query or navigate XML documents.

https://devhints.io/xpath
# Xpath cheatsheet.

https://www.s4msecurity.com/2022/06/08/xml-xpath-injection-search-bwapp-level-low/
# This article subject XML/XPath Injection vulnerability on web app.