Fallos del tipo CWE-116

371 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2024-34510HIGHGradio before 4.20 allows credential leakage on Windows.EPSS 0.6%CVE-2024-56524CRITICALRadware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special characEPSS 0.6%CVE-2023-42183MEDIUMlockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrEPSS 0.6%CVE-2026-73417HIGHJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)EPSS 0.6%CVE-2026-50659MEDIUM.NET Spoofing VulnerabilityEPSS 0.5%CVE-2020-29023LOWCSV Formula Injection possible due to improper fields escaping in GateManagerEPSS 0.5%CVE-2022-28284HIGHSVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstanEPSS 0.5%CVE-2026-24737HIGHjsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionEPSS 0.5%CVE-2021-25254HIGHYandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.EPSS 0.5%CVE-2023-3552HIGHImproper Encoding or Escaping of Output in nilsteampassnet/teampassEPSS 0.5%CVE-2022-41322HIGHIn Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user mEPSS 0.5%CVE-2026-34479MEDIUMApache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersEPSS 0.5%CVE-2026-59833HIGHSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)EPSS 0.5%CVE-2026-32754CRITICALFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})EPSS 0.5%CVE-2023-3190LOWImproper Encoding or Escaping of Output in nilsteampassnet/teampassEPSS 0.5%CVE-2023-29543HIGHAn attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vectEPSS 0.5%CVE-2025-8405HIGHImproper Encoding or Escaping of Output in GitLabEPSS 0.5%CVE-2022-43713—Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validEPSS 0.5%CVE-2023-39527HIGHPrestaShop XSS vulnerability through Validate::isCleanHTML methodEPSS 0.5%CVE-2024-52005HIGHThe sideband payload is passed unfiltered to the terminal in gitEPSS 0.5%