Weaknesses of type CWE-116

371 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2026-12047MEDIUMpgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textEPSS 0.2%CVE-2026-48209HIGHReflected XSS in authenticated agent contextEPSS 0.2%CVE-2026-84655MEDIUMJenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST APIEPSS 0.2%CVE-2026-42040LOWAxios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsEPSS 0.2%CVE-2023-26279LOWIBM QRadar WinCollect Agent improper output encodingEPSS 0.2%CVE-2026-13407MEDIUMRoyal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification EmailsEPSS 0.2%CVE-2026-34246MEDIUMCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML OutputEPSS 0.2%CVE-2026-45011HIGHApostrophe has stored XSS via javascript: URL in Image Widget LinkEPSS 0.2%CVE-2026-25230MEDIUMFileRise affected by HTML Injection using color property in file tagsEPSS 0.2%CVE-2026-79952MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper EncodingEPSS 0.2%CVE-2026-40302MEDIUMzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingEPSS 0.2%CVE-2026-54705MEDIUMmathlive's Lack of Escaping of HTML allows for XSSEPSS 0.2%CVE-2026-73055MEDIUMShescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBoxEPSS 0.2%CVE-2026-79964MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 0.2%CVE-2024-27629HIGHAn issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaEPSS 0.2%CVE-2026-54893LOWEmail-derived URL path injection in the Swoosh Microsoft Graph adapterEPSS 0.2%CVE-2026-58504MEDIUMdraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642EPSS 0.2%CVE-2026-40593MEDIUMChurchCRM: Stored XSS in UserEditor.php via Login Name FieldEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%CVE-2026-52772MEDIUMYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)EPSS 0.2%