Fallos del tipo CWE-116

427 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2021-39170HIGHImproper Encoding or Escaping of Output in Asset Metadata ComponentEPSS 1.2%CVE-2024-45498HIGHApache Airflow: Command Injection in an example DAGEPSS 1.2%CVE-2024-45219HIGHApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureEPSS 1.2%CVE-2026-48358CRITICALAdobe Commerce | Improper Encoding or Escaping of Output (CWE-116)EPSS 1.2%CVE-2023-26472CRITICALXWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profileEPSS 1.1%CVE-2026-94545MEDIUMSatori-generated SVG has improper escapingEPSS 1.1%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2026-34480MEDIUMApache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersEPSS 1.0%CVE-2021-41132CRITICALInconsistent input sanitisation leads to XSS vectorsEPSS 1.0%CVE-2024-52006LOWNewline confusion in credential helpers can lead to credential exfiltration in gitEPSS 1.0%CVE-2018-8920MEDIUMImproper neutralization of escape vulnerability in Log Exporter in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attacEPSS 1.0%CVE-2022-29258HIGHCross-site Scripting in Filter Stream Converter Application in XWiki PlatformEPSS 1.0%CVE-2022-29252HIGHCross-site Scripting in XWiki Platform Wiki UI Main WikiEPSS 1.0%CVE-2023-3668CRITICALImproper Encoding or Escaping of Output in froxlor/froxlorEPSS 1.0%CVE-2026-44266CRITICALElo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsEPSS 1.0%CVE-2022-23603CRITICALCode injection in iTunesRPC-Remastered EPSS 1.0%CVE-2025-40547CRITICALSolarWinds Serv-U Logic Abuse - Remote Code Execution VulnerabilityEPSS 1.0%CVE-2026-25755HIGHjsPDF has PDF Object Injection via Unsanitized Input in addJS MethodEPSS 1.0%CVE-2023-48655CRITICALAn issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parametEPSS 0.9%CVE-2023-40453—Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentiallyEPSS 0.9%