Fallos del tipo CWE-116

372 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2026-15809HIGHGithub.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home envEPSS 0.2%CVE-2023-3481MEDIUMXSS in Chrome Lab CrittersEPSS 0.2%CVE-2026-33436LOWStirling-PDF: Reflected XSS through crafted filename in file upload functionalityEPSS 0.2%CVE-2026-35534HIGHChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionEPSS 0.2%CVE-2026-82249LOWgitoxide before 0.38.2 Credential Helper Protocol Field InjectionEPSS 0.2%CVE-2026-44429MEDIUMMCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`EPSS 0.2%CVE-2026-77353MEDIUMWallos: iCalendar Injection via CRLF in Subscription Name/Notes ExportEPSS 0.2%CVE-2026-0818MEDIUMCSS-based exfiltration of the content from partially encrypted emails when allowing remote contentEPSS 0.2%CVE-2023-28738HIGHImproper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatioEPSS 0.2%CVE-2026-32986MEDIUMTextpattern CMS 4.9.0: Second-Order XSS via Atom Feed InjectionEPSS 0.2%CVE-2026-44713HIGHpam_usb: Command injection via $TMUX environment variable leads to RCE as rootEPSS 0.2%CVE-2025-1308HIGHPX Backup Improper Sanitization VulnerabilityEPSS 0.2%CVE-2025-66548LOWNextcloud Deck app allows to spoof file extensions by using RTLO charactersEPSS 0.2%CVE-2026-41426MEDIUMpretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templatesEPSS 0.2%CVE-2026-40011LOWPrometheus denial of service via crafted DNS queriesEPSS 0.2%CVE-2026-29106MEDIUMSuiteCRM has blind XSS in return_id parameterEPSS 0.1%CVE-2026-8795HIGHA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostnamEPSS 0.1%CVE-2025-23377MEDIUMDell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. A higEPSS 0.1%CVE-2026-21443LOWOpenEMR allows inconsistent escaping of translation function outputEPSS 0.1%CVE-2025-62315LOWHCL AION is affected by multiple security vulnerabilities.EPSS 0.1%