Weaknesses of type CWE-116

427 results

Codificação ou escape inadequado de saída

A aplicação falha em codificar ou fazer escape apropriado dos dados antes de enviá-los ao usuário, permitindo que caracteres especiais sejam interpretados como código (HTML, JavaScript, SQL, etc.). Isso abre brecha para injeção de payload malicioso, especialmente XSS em contextos web.

Example

Um formulário de busca que exibe o termo pesquisado sem escape: se o usuário digita '<img src=x onerror=alert(1)>', a página renderiza o JavaScript em vez de mostrar o texto como string inócua.

How to mitigate

Aplique escape contextual (HTML entity encoding para HTML, JavaScript encoding para scripts, URL encoding para parâmetros) usando bibliotecas consolidadas da sua stack (DOMPurify, OWASP ESAPI, etc.). Validar entrada é primeira linha de defesa, mas escape de saída é crítico e obrigatório.

CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.5%CVE-2024-9348HIGHDocker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build viewEPSS 0.5%CVE-2026-34483HIGHApache Tomcat: Incomplete escaping of JSON access logsEPSS 0.5%CVE-2026-63470CRITICALfastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringEPSS 0.5%CVE-2026-82681LOWQuery-parameter injection in AshAdmin row-action links via unencoded string primary keysEPSS 0.5%CVE-2025-36254HIGHDS8900F and DS8A00 Authentication BypassEPSS 0.5%CVE-2026-33301HIGHOpenEMR has arbitrary image file read via PDF generatorEPSS 0.5%CVE-2026-81522HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ DriverEPSS 0.5%CVE-2023-2200MEDIUMImproper Encoding or Escaping of Output in GitLabEPSS 0.5%CVE-2024-6329MEDIUMImproper Encoding or Escaping of Output in GitLabEPSS 0.5%CVE-2025-61912MEDIUMpython-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null TerminationEPSS 0.5%CVE-2021-25262MEDIUMYandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.EPSS 0.5%CVE-2023-39390—Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerabilityEPSS 0.4%CVE-2023-39382— Input verification vulnerability in the audio module. Successful exploitation of this vulnerability may cause virtual machines (VMs) to resEPSS 0.4%CVE-2023-39381— Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart.EPSS 0.4%CVE-2023-39386—Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newEPSS 0.4%CVE-2025-4084MEDIUMPotential local code execution in "copy as cURL" commandEPSS 0.4%CVE-2025-64325HIGHEmby Server is Vulnerable to Remote Code Execution Through XSS in Admin DashboardEPSS 0.4%CVE-2026-73157LOWcti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event MetadataEPSS 0.4%CVE-2024-35225CRITICALJupyter Server Proxy has a reflected XSS issue in host parameterEPSS 0.4%