Weaknesses of type CWE-116

427 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2026-54133CRITICALjmespath.php has CompilerRuntime code injection via unescaped function namesEPSS 0.4%CVE-2025-46583MEDIUMDOS Vulnerability in ZTE MC889A Pro productEPSS 0.4%CVE-2024-4177HIGHHost whitelist parser issue in GravityZone Console On-Premise (VA-11554)EPSS 0.4%CVE-2026-54364MEDIUMCentreStack < 17.4 Session Injection via SelectProvider.aspxEPSS 0.4%CVE-2026-42810CRITICALApache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table namesEPSS 0.4%CVE-2023-32301LOWDiscourse's canonical url not being used for topic embeddingsEPSS 0.4%CVE-2025-25029MEDIUMIBM Security Guardium information disclosureEPSS 0.4%CVE-2025-24338HIGHA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attEPSS 0.4%CVE-2024-7873CRITICALStored XSS in Veribilim Software's Veribase Order ManagementEPSS 0.4%CVE-2025-30657MEDIUMJunos OS: Processing of a specific BGP update causes the SRRD process to crashEPSS 0.4%CVE-2026-82958HIGHIn Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command byEPSS 0.4%CVE-2024-47528MEDIUMLibreNMS Contains a Stored XSS via File UploadEPSS 0.4%CVE-2026-61824HIGHDefuddle: XSS via unescaped attribute interpolation in site extractorsEPSS 0.4%CVE-2026-47171HIGHQuest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`EPSS 0.4%CVE-2026-110757CRITICALText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combineEPSS 0.4%CVE-2024-47845MEDIUMCSS sanitizer used incorrectly, and is easily bypassedEPSS 0.4%CVE-2026-110756CRITICALText::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in printEPSS 0.4%CVE-2025-23207MEDIUM\htmlData does not validate attribute names in KaTeXEPSS 0.4%CVE-2025-32078MEDIUMXSSes and potential RCE in Special:VersionCompareEPSS 0.4%CVE-2024-28245MEDIUMKaTeX's \includegraphics does not escape filenameEPSS 0.4%