Fallos del tipo CWE-116

427 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2026-49091HIGHImproper Output Neutralization for Logs in Kibana Leading to Log InjectionEPSS 0.3%CVE-2026-64647MEDIUMNext.js: Response Body Cache Confusion with Invalid UTF-8 Request BodiesEPSS 0.3%CVE-2026-63469CRITICALfastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dictEPSS 0.3%CVE-2026-32811HIGHHeimdall: Path received via Envoy gRPC corrupted when containing query stringEPSS 0.3%CVE-2026-63471CRITICALfastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decoratorEPSS 0.3%CVE-2025-12697LOWImproper Encoding or Escaping of Output in GitLabEPSS 0.3%CVE-2026-54287MEDIUMHono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeEPSS 0.3%CVE-2026-35208MEDIUMlichess.org has an Unsanitized Stream Title Injection on /streamerEPSS 0.3%CVE-2026-28898MEDIUMswift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control characters before placing them into the translaEPSS 0.3%CVE-2026-63329MEDIUMWarpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend TargetsEPSS 0.3%CVE-2026-57210HIGHHeimdall: IP Spoofing via Unvalidated Forwarding HeadersEPSS 0.3%CVE-2026-63208MEDIUMZammad: Microsoft Graph error logs expose partially masked OAuth access tokensEPSS 0.3%CVE-2026-46637MEDIUMTwig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`EPSS 0.3%CVE-2026-28907HIGHThe issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOEPSS 0.3%CVE-2025-5271MEDIUMDevtools' preview ignored CSP headersEPSS 0.3%CVE-2026-95274HIGHImproper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer procEPSS 0.3%CVE-2026-110725LOWfast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesEPSS 0.3%CVE-2025-47280LOWUmbraco.Forms has HTML injection vulnerability in 'Send email' workflowEPSS 0.3%CVE-2026-54013HIGHOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUIEPSS 0.3%CVE-2026-54705MEDIUMmathlive's Lack of Escaping of HTML allows for XSSEPSS 0.3%