Fallos del tipo CWE-116

371 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2025-36254HIGHDS8900F and DS8A00 Authentication BypassEPSS 0.4%CVE-2026-55730HIGHLoytec LWEB802: Reflected Cross-Site Scripting in LWEB802EPSS 0.4%CVE-2026-12496HIGHLoytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA serverEPSS 0.4%CVE-2026-88921MEDIUMMISP: Unescaped HTML Injection in PDF Report Element RenderingEPSS 0.4%CVE-2026-31898HIGHjsPDF has a PDF Object Injection via FreeText colorEPSS 0.4%CVE-2026-83610MEDIUMxmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationEPSS 0.4%CVE-2026-27169HIGHOpenSift: Persistent XSS Chat Tool RenderingEPSS 0.4%CVE-2026-64647MEDIUMNext.js: Response Body Cache Confusion with Invalid UTF-8 Request BodiesEPSS 0.4%CVE-2026-33597LOWPRSD detection denial of serviceEPSS 0.3%CVE-2025-11085HIGHFactoryTalk® DataMosaix™ Private Cloud – Persistent XSSEPSS 0.3%CVE-2025-15312MEDIUMTanium addressed an improper output sanitization vulnerability in TanOS.EPSS 0.3%CVE-2026-42321HIGHGLPI has stored XSS in asset locksEPSS 0.3%CVE-2026-19641MEDIUMOn affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitEPSS 0.3%CVE-2025-32974CRITICALorg.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typeEPSS 0.3%CVE-2025-8276MEDIUMHTML Injection in Patika Global Technologies' HumanSuiteEPSS 0.3%CVE-2025-55903HIGHA HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field withEPSS 0.3%CVE-2023-52102HIGHVulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affect service confidentEPSS 0.3%CVE-2026-9354MEDIUMNousResearch hermes-agent Slack Agent/Mattermost Agent escape outputEPSS 0.3%CVE-2026-73411MEDIUMShescape: Home-directory disclosure in assignment context on Unix with DashEPSS 0.3%CVE-2026-73195HIGHApache Syncope: CSV export spreadsheet formula injectionEPSS 0.3%