Core Rule Set (< 3.3.10, 4.25.1, 4.28.0)

The OWASP Core Rule Set (CRS) fails to inspect XML attribute values due to limited XPath coverage, allowing attackers to bypass critical web application firewall detection rules by embedding payloads within XML attributes.