Weaknesses of type CWE-116

371 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2024-38474HIGHApache HTTP Server weakness with encoded question marks in backreferencesEPSS 2.5%CVE-2022-40870HIGHThe Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackEPSS 2.0%CVE-2024-46901LOWApache Subversion: mod_dav_svn denial-of-service via control characters in pathsEPSS 1.9%CVE-2025-34141MEDIUMETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`EPSS 1.9%CVE-2019-9852—Insufficient URL encoding flaw in allowed script location checkEPSS 1.9%CVE-2020-13654HIGHXWiki Platform before 12.8 mishandles escaping in the property displayer.EPSS 1.9%CVE-2023-45135CRITICALXWiki users can be tricked to execute scripts as the create page action doesn't display the page's titleEPSS 1.7%CVE-2021-34630MEDIUMReflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.65EPSS 1.6%CVE-2021-42010CRITICALCRLF log injectionEPSS 1.6%CVE-2023-45539HIGHHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspEPSS 1.5%CVE-2020-26283MEDIUMControl character injection in console outputEPSS 1.5%CVE-2026-48358CRITICALAdobe Commerce | Improper Encoding or Escaping of Output (CWE-116)EPSS 1.5%CVE-2024-31866CRITICALApache Zeppelin: Interpreter download command does not escape malicious code injectionEPSS 1.4%CVE-2020-26226HIGHSecret disclosure in semantic-releaseEPSS 1.4%CVE-2022-23079—motoradmin - host header Injection in the reset password functionalityEPSS 1.4%CVE-2021-41191HIGHAPI giving out files without keyEPSS 1.4%CVE-2021-32679LOWFilenames not escaped by default in controllers using DownloadResponseEPSS 1.4%CVE-2021-32796MEDIUMMisinterpretation of malicious XML input in xmldomEPSS 1.4%CVE-2022-22744HIGHThe constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to coEPSS 1.3%CVE-2022-29251HIGHCross-site Scripting in the Flamingo theme managerEPSS 1.3%