Fallos del tipo CWE-116

371 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2026-12047MEDIUMpgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textEPSS 0.2%CVE-2026-48209HIGHReflected XSS in authenticated agent contextEPSS 0.2%CVE-2026-84655MEDIUMJenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST APIEPSS 0.2%CVE-2026-42040LOWAxios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsEPSS 0.2%CVE-2023-26279LOWIBM QRadar WinCollect Agent improper output encodingEPSS 0.2%CVE-2026-13407MEDIUMRoyal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification EmailsEPSS 0.2%CVE-2026-34246MEDIUMCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML OutputEPSS 0.2%CVE-2026-45011HIGHApostrophe has stored XSS via javascript: URL in Image Widget LinkEPSS 0.2%CVE-2026-25230MEDIUMFileRise affected by HTML Injection using color property in file tagsEPSS 0.2%CVE-2026-79952MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper EncodingEPSS 0.2%CVE-2026-40302MEDIUMzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingEPSS 0.2%CVE-2026-54705MEDIUMmathlive's Lack of Escaping of HTML allows for XSSEPSS 0.2%CVE-2026-73055MEDIUMShescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBoxEPSS 0.2%CVE-2026-79964MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 0.2%CVE-2024-27629HIGHAn issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaEPSS 0.2%CVE-2026-54893LOWEmail-derived URL path injection in the Swoosh Microsoft Graph adapterEPSS 0.2%CVE-2026-58504MEDIUMdraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642EPSS 0.2%CVE-2026-40593MEDIUMChurchCRM: Stored XSS in UserEditor.php via Login Name FieldEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%CVE-2026-52772MEDIUMYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)EPSS 0.2%