Fallos del tipo CWE-116

428 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2026-77353MEDIUMWallos: iCalendar Injection via CRLF in Subscription Name/Notes ExportEPSS 0.3%CVE-2025-30345LOWAn issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify thEPSS 0.3%CVE-2025-11713HIGHPotential user-assisted code execution in “Copy as cURL” commandEPSS 0.3%CVE-2026-110910MEDIUMqs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injectionEPSS 0.3%CVE-2025-63785MEDIUMA DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerabilEPSS 0.3%CVE-2026-1011MEDIUMStored Cross-Site Scripting in Altium Live Support Center Comment EndpointEPSS 0.3%CVE-2026-25932HIGHGLPI has Stored XSS in Supplier 'Website' fieldEPSS 0.3%CVE-2023-31669MEDIUMWebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").EPSS 0.3%CVE-2026-111059MEDIUMMercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLEPSS 0.3%CVE-2026-27812HIGHSub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account TakeoverEPSS 0.3%CVE-2025-68460HIGHRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.EPSS 0.3%CVE-2026-43938HIGHYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` HeaderEPSS 0.3%CVE-2026-28348MEDIUMlxml_html_clean: CSS @import Filter Bypass via Unicode EscapesEPSS 0.3%CVE-2026-28499MEDIUMLeafKit's HTML escaping may be skipped for Collection values, enabling XSSEPSS 0.3%CVE-2026-88058HIGHAngular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsEPSS 0.3%CVE-2026-26952MEDIUMPi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag AttributeEPSS 0.3%CVE-2026-55214HIGHGLPI: Stored XSS in suppliersEPSS 0.3%CVE-2025-27108HIGHCross-site Scripting vulnerability due to improper use of string.replace in dom-expressionsEPSS 0.3%CVE-2026-107845CRITICALContao: Cross-site scripting in the comments bundleEPSS 0.3%CVE-2026-53693MEDIUMMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsEPSS 0.3%