Fallos del tipo CWE-116

417 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2024-4177HIGHHost whitelist parser issue in GravityZone Console On-Premise (VA-11554)EPSS 0.4%CVE-2026-54364MEDIUMCentreStack < 17.4 Session Injection via SelectProvider.aspxEPSS 0.4%CVE-2026-42810CRITICALApache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table namesEPSS 0.4%CVE-2023-32301LOWDiscourse's canonical url not being used for topic embeddingsEPSS 0.4%CVE-2025-25029MEDIUMIBM Security Guardium information disclosureEPSS 0.4%CVE-2025-24338HIGHA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attEPSS 0.4%CVE-2024-7873CRITICALStored XSS in Veribilim Software's Veribase Order ManagementEPSS 0.4%CVE-2026-82958HIGHIn Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command byEPSS 0.4%CVE-2024-47528MEDIUMLibreNMS Contains a Stored XSS via File UploadEPSS 0.4%CVE-2026-61824HIGHDefuddle: XSS via unescaped attribute interpolation in site extractorsEPSS 0.4%CVE-2026-47171HIGHQuest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`EPSS 0.4%CVE-2026-110757CRITICALText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combineEPSS 0.4%CVE-2024-47845MEDIUMCSS sanitizer used incorrectly, and is easily bypassedEPSS 0.4%CVE-2026-110756CRITICALText::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in printEPSS 0.4%CVE-2025-23207MEDIUM\htmlData does not validate attribute names in KaTeXEPSS 0.4%CVE-2024-28245MEDIUMKaTeX's \includegraphics does not escape filenameEPSS 0.4%CVE-2025-30657MEDIUMJunos OS: Processing of a specific BGP update causes the SRRD process to crashEPSS 0.4%CVE-2025-59936CRITICALget-jwks poisoned JWKS cache allows post-fetch issuer validation bypassEPSS 0.4%CVE-2026-55570CRITICALSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)EPSS 0.4%CVE-2026-13635MEDIUMAn improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280EPSS 0.4%