Weaknesses of type CWE-116

371 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2021-39170HIGHImproper Encoding or Escaping of Output in Asset Metadata ComponentEPSS 1.2%CVE-2024-10441CRITICALImproper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and SynolEPSS 1.2%CVE-2024-45498HIGHApache Airflow: Command Injection in an example DAGEPSS 1.2%CVE-2024-45219HIGHApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureEPSS 1.2%CVE-2023-26472CRITICALXWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profileEPSS 1.1%CVE-2024-52006LOWNewline confusion in credential helpers can lead to credential exfiltration in gitEPSS 1.1%CVE-2021-41132CRITICALInconsistent input sanitisation leads to XSS vectorsEPSS 1.0%CVE-2018-8920MEDIUMImproper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attacEPSS 1.0%CVE-2023-3668CRITICALImproper Encoding or Escaping of Output in froxlor/froxlorEPSS 1.0%CVE-2022-23603CRITICALCode injection in iTunesRPC-Remastered EPSS 1.0%CVE-2026-34480MEDIUMApache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersEPSS 1.0%CVE-2022-29252HIGHCross-site Scripting in XWiki Platform Wiki UI Main WikiEPSS 1.0%CVE-2022-29258HIGHCross-site Scripting in Filter Stream Converter Application in XWiki PlatformEPSS 1.0%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2023-48655CRITICALAn issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parametEPSS 0.9%CVE-2023-40453—Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentiallyEPSS 0.9%CVE-2024-29894MEDIUMCacti Cross-site Scripting vulnerability when using JavaScript based messaging APIEPSS 0.9%CVE-2025-40547CRITICALSolarWinds Serv-U Logic Abuse - Remote Code Execution VulnerabilityEPSS 0.9%CVE-2023-28101MEDIUMFlatpak metadata with ANSI control codes can cause misleading terminal outputEPSS 0.9%CVE-2026-56379CRITICALImageMagick - Command Injection via SVG DecoderEPSS 0.9%