Weaknesses of type CWE-116

372 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2026-15809HIGHGithub.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home envEPSS 0.2%CVE-2023-3481MEDIUMXSS in Chrome Lab CrittersEPSS 0.2%CVE-2026-33436LOWStirling-PDF: Reflected XSS through crafted filename in file upload functionalityEPSS 0.2%CVE-2026-35534HIGHChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionEPSS 0.2%CVE-2026-82249LOWgitoxide before 0.38.2 Credential Helper Protocol Field InjectionEPSS 0.2%CVE-2026-44429MEDIUMMCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`EPSS 0.2%CVE-2026-77353MEDIUMWallos: iCalendar Injection via CRLF in Subscription Name/Notes ExportEPSS 0.2%CVE-2026-0818MEDIUMCSS-based exfiltration of the content from partially encrypted emails when allowing remote contentEPSS 0.2%CVE-2023-28738HIGHImproper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatioEPSS 0.2%CVE-2026-32986MEDIUMTextpattern CMS 4.9.0: Second-Order XSS via Atom Feed InjectionEPSS 0.2%CVE-2026-44713HIGHpam_usb: Command injection via $TMUX environment variable leads to RCE as rootEPSS 0.2%CVE-2025-1308HIGHPX Backup Improper Sanitization VulnerabilityEPSS 0.2%CVE-2025-66548LOWNextcloud Deck app allows to spoof file extensions by using RTLO charactersEPSS 0.2%CVE-2026-41426MEDIUMpretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templatesEPSS 0.2%CVE-2026-40011LOWPrometheus denial of service via crafted DNS queriesEPSS 0.2%CVE-2026-29106MEDIUMSuiteCRM has blind XSS in return_id parameterEPSS 0.1%CVE-2026-8795HIGHA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostnamEPSS 0.1%CVE-2025-23377MEDIUMDell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A higEPSS 0.1%CVE-2026-21443LOWOpenEMR allows inconsistent escaping of translation function outputEPSS 0.1%CVE-2025-62315LOWHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%