Weaknesses of type CWE-116

371 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2025-36254HIGHDS8900F and DS8A00 Authentication BypassEPSS 0.4%CVE-2026-55730HIGHLoytec LWEB802: Reflected Cross-Site Scripting in LWEB802EPSS 0.4%CVE-2026-12496HIGHLoytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA serverEPSS 0.4%CVE-2026-88921MEDIUMMISP: Unescaped HTML Injection in PDF Report Element RenderingEPSS 0.4%CVE-2026-31898HIGHjsPDF has a PDF Object Injection via FreeText colorEPSS 0.4%CVE-2026-83610MEDIUMxmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationEPSS 0.4%CVE-2026-27169HIGHOpenSift: Persistent XSS Chat Tool RenderingEPSS 0.4%CVE-2026-64647MEDIUMNext.js: Response Body Cache Confusion with Invalid UTF-8 Request BodiesEPSS 0.4%CVE-2026-33597LOWPRSD detection denial of serviceEPSS 0.3%CVE-2025-11085HIGHFactoryTalk® DataMosaix™ Private Cloud – Persistent XSSEPSS 0.3%CVE-2025-15312MEDIUMTanium addressed an improper output sanitization vulnerability in TanOS.EPSS 0.3%CVE-2026-42321HIGHGLPI has stored XSS in asset locksEPSS 0.3%CVE-2026-19641MEDIUMOn affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitEPSS 0.3%CVE-2025-32974CRITICALorg.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typeEPSS 0.3%CVE-2025-8276MEDIUMHTML Injection in Patika Global Technologies' HumanSuiteEPSS 0.3%CVE-2025-55903HIGHA HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field withEPSS 0.3%CVE-2023-52102HIGHVulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentEPSS 0.3%CVE-2026-9354MEDIUMNousResearch hermes-agent Slack Agent/Mattermost Agent escape outputEPSS 0.3%CVE-2026-73411MEDIUMShescape: Home-directory disclosure in assignment context on Unix with DashEPSS 0.3%CVE-2026-73195HIGHApache Syncope: CSV export spreadsheet formula injectionEPSS 0.3%