Fallos del tipo CWE-116

427 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2024-29894MEDIUMCacti Cross-site Scripting vulnerability when using JavaScript based messaging APIEPSS 0.9%CVE-2023-28101MEDIUMFlatpak metadata with ANSI control codes can cause misleading terminal outputEPSS 0.9%CVE-2021-23205HIGHImproper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers EPSS 0.9%CVE-2022-46387CRITICALConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to chEPSS 0.9%CVE-2025-49013CRITICALWilderForge vulnerable to code Injection via GitHub Actions WorkflowsEPSS 0.9%CVE-2026-35582HIGHEmissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in ExecutrixEPSS 0.9%CVE-2024-38177HIGHWindows App Installer Spoofing VulnerabilityEPSS 0.9%CVE-2026-22792CRITICAL5ire vulnerable to Remote Code Execution (RCE)EPSS 0.9%CVE-2021-32812MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.jsEPSS 0.8%CVE-2026-105244MEDIUMApache log4net: RemoteSyslogAppender silently deletes non-ASCII contentEPSS 0.8%CVE-2023-35941HIGHEnvoy vulnerable to OAuth2 credentials exploit with permanent validityEPSS 0.8%CVE-2026-107823HIGHMariaDB: privilege escalation via incorrect view frm parsingEPSS 0.8%CVE-2026-54182HIGHbackpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)EPSS 0.8%CVE-2024-58266LOWThe shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injEPSS 0.8%CVE-2019-3571—An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that woEPSS 0.8%CVE-2026-40021MEDIUMApache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden charactersEPSS 0.8%CVE-2024-55663HIGHXWiki Platform has an SQL injection in getdocuments.vm with sort parameterEPSS 0.8%CVE-2026-73417HIGHJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)EPSS 0.7%CVE-2024-29156MEDIUMIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to saEPSS 0.7%CVE-2023-40014MEDIUMOpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSenderEPSS 0.7%