I found an article with example of executing dynamic PL\\SQL code inside of dbms_xmlquery.getxml(..) function. This article is https://github.com/swisskyrepo/PayloadsAllTheT