Describe the bug:

As shown in the figure below, Active scan is performed on the selected URL. After the scan is completed, there is no high-risk Xpath injecion prompt

And, I enter the following URL in the browser and all user information is returned
http://localhost:8081/xpathLogin?username=admin' or '1'='1&password=anything

Steps to reproduce the behavior:

1 choose the xpathLogin url
2 right click
3 select Attach
4 click Active Scan
5 start scan

Expected behavior:

XPath injection risk is detected

Software Versions:

2.16.1

Screenshots:

Errors from the zap.log file:

No response

Additional context:

No response

Would you like to help fix this issue?

• Yes