Fallos del tipo CWE-116

371 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2025-5271MEDIUMDevtools' preview ignored CSP headersEPSS 0.3%CVE-2026-28907HIGHThe issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOEPSS 0.3%CVE-2026-24127MEDIUMTypemill has Reflected XSS via login error view templateEPSS 0.3%CVE-2026-32811HIGHHeimdall: Path received via Envoy gRPC corrupted when containing query stringEPSS 0.3%CVE-2026-55618MEDIUMeml_parser: URL extraction bypass via HTML entities in URLsEPSS 0.3%CVE-2026-54013HIGHOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUIEPSS 0.3%CVE-2026-50642MEDIUMTerminal Escape Injection in diff‑so‑fancyEPSS 0.3%CVE-2026-35208MEDIUMlichess.org has an Unsanitized Stream Title Injection on /streamerEPSS 0.3%CVE-2026-35569HIGHApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMSEPSS 0.3%CVE-2023-45359MEDIUMAn issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label isEPSS 0.3%CVE-2026-55859MEDIUMMariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadbEPSS 0.3%CVE-2024-9427MEDIUMKoji: escape html tag characters in the query stringEPSS 0.3%CVE-2024-4099LOWImproper Encoding or Escaping of Output in GitLabEPSS 0.3%CVE-2026-46628MEDIUMTwig: The `spaceless` filter implicitly marks its output as safeEPSS 0.3%CVE-2025-12697LOWImproper Encoding or Escaping of Output in GitLabEPSS 0.3%CVE-2023-37875LOWCross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0EPSS 0.3%CVE-2026-33941HIGHHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and OptionsEPSS 0.3%CVE-2026-1011MEDIUMStored Cross-Site Scripting in Altium Live Support Center Comment EndpointEPSS 0.3%CVE-2026-33758CRITICALOpenBao has Reflected XSS in its OIDC authentication error messageEPSS 0.3%CVE-2026-27013HIGHFabric.js Affected by Stored XSS via SVG ExportEPSS 0.3%