Weaknesses of type CWE-116

427 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2024-29894MEDIUMCacti Cross-site Scripting vulnerability when using JavaScript based messaging APIEPSS 0.9%CVE-2023-28101MEDIUMFlatpak metadata with ANSI control codes can cause misleading terminal outputEPSS 0.9%CVE-2021-23205HIGHImproper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers EPSS 0.9%CVE-2022-46387CRITICALConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to chEPSS 0.9%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.9%CVE-2026-35582HIGHEmissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in ExecutrixEPSS 0.9%CVE-2024-38177HIGHWindows App Installer Spoofing VulnerabilityEPSS 0.9%CVE-2026-22792CRITICAL5ire vulnerable to Remote Code Execution (RCE)EPSS 0.9%CVE-2021-32812MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.jsEPSS 0.8%CVE-2026-105244MEDIUMApache log4net: RemoteSyslogAppender silently deletes non-ASCII contentEPSS 0.8%CVE-2023-35941HIGHEnvoy vulnerable to OAuth2 credentials exploit with permanent validityEPSS 0.8%CVE-2026-107823HIGHMariaDB: privilege escalation via incorrect view frm parsingEPSS 0.8%CVE-2026-54182HIGHbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)EPSS 0.8%CVE-2024-58266LOWThe shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injEPSS 0.8%CVE-2019-3571—An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that woEPSS 0.8%CVE-2026-40021MEDIUMApache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden charactersEPSS 0.8%CVE-2024-55663HIGHXWiki Platform has an SQL injection in getdocuments.vm with sort parameterEPSS 0.8%CVE-2026-73417HIGHJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)EPSS 0.7%CVE-2024-29156MEDIUMIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to saEPSS 0.7%CVE-2023-29541HIGHFirefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commEPSS 0.7%