Fallos del tipo CWE-116

371 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2025-47280LOWUmbraco.Forms has HTML injection vulnerability in 'Send email' workflowEPSS 0.3%CVE-2023-31669MEDIUMWebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").EPSS 0.3%CVE-2025-68460HIGHRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.EPSS 0.3%CVE-2026-23630MEDIUMDocmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid renderingEPSS 0.3%CVE-2025-30345LOWAn issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify thEPSS 0.3%CVE-2024-56277MEDIUMWordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerabilityEPSS 0.3%CVE-2026-61399MEDIUMApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UIEPSS 0.3%CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.3%CVE-2026-43938HIGHYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderEPSS 0.3%CVE-2026-25932HIGHGLPI has Stored XSS in Supplier 'Website' fieldEPSS 0.3%CVE-2025-27108HIGHCross-site Scripting vulnerability due to improper use of string.replace in dom-expressionsEPSS 0.3%CVE-2026-53693MEDIUMMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsEPSS 0.3%CVE-2024-34715LOWPartial Password Exposure Vulnerability in Fides Webserver LogsEPSS 0.3%CVE-2025-11712MEDIUMAn OBJECT tag type attribute overrode browser behavior on web resources without a content-typeEPSS 0.3%CVE-2026-48598LOWCRLF injection in Tesla.Multipart disposition parameters allows multipart part header injectionEPSS 0.3%CVE-2026-44311MEDIUMFabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serializationEPSS 0.3%CVE-2025-12734LOWImproper Encoding or Escaping of Output in GitLabEPSS 0.3%CVE-2026-23880HIGHOnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take OverEPSS 0.3%CVE-2026-82681LOWQuery-parameter injection in AshAdmin row-action links via unencoded string primary keysEPSS 0.3%CVE-2026-12048CRITICALpgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parserEPSS 0.3%