Weaknesses of type CWE-116

371 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2026-44458MEDIUMHono: CSS Declaration Injection via Style Object Values in JSX SSREPSS 0.2%CVE-2026-41318MEDIUMAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentEPSS 0.2%CVE-2026-72925MEDIUMSWC HTML minifier may allow script element breakout when minifying embedded JSONEPSS 0.2%CVE-2025-46703MEDIUMPotential XSS in Extension:AtMentionsEPSS 0.2%CVE-2025-48007MEDIUMPotential XSS in Extension:BlueSpiceAvatarsEPSS 0.2%CVE-2026-26027HIGHGLPI has an Unauthenticated Stored XSS via inventoryEPSS 0.2%CVE-2026-27512MEDIUMTenda F3 Reflected Script Execution via Missing nosniff HeaderEPSS 0.2%CVE-2026-52846MEDIUMCaddy: stripHTML template function bypassEPSS 0.2%CVE-2025-0607MEDIUMHTML Injection in Logo Software's Logo CloudEPSS 0.2%CVE-2024-34739HIGHIn shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the cEPSS 0.2%CVE-2026-2404MEDIUMCWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters tEPSS 0.2%CVE-2026-31859MEDIUMCraft has Reflective XSS via incomplete return URL sanitizationEPSS 0.2%CVE-2025-66488MEDIUMDiscourse allows script execution in uploaded HTML/XML files on S3EPSS 0.2%CVE-2026-63466MEDIUMUnleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernameEPSS 0.2%CVE-2025-13742LOWLimited HTML injection in emailsEPSS 0.2%CVE-2026-6058MEDIUM** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00EPSS 0.2%CVE-2026-24439LOWTenda W30E V2 Lacks X-Content-Type-Options HeaderEPSS 0.2%CVE-2026-81685CRITICALopenssl_encrypt before 1.4.9 Text Injection via Recovery Slot MetadataEPSS 0.2%CVE-2025-57880MEDIUMPotential XSS in Extension:BlueSpiceWhoIsOnlineEPSS 0.2%CVE-2026-33657MEDIUMEspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post fieldEPSS 0.2%