Fallos del tipo CWE-116

427 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2026-61398CRITICALApache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UIEPSS 0.6%CVE-2023-42183MEDIUMlockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrEPSS 0.6%CVE-2021-25254HIGHYandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.EPSS 0.6%CVE-2026-32754CRITICALFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})EPSS 0.6%CVE-2023-5654MEDIUMThe React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script thaEPSS 0.6%CVE-2026-62184HIGHluci-app-banip Log Monitor IP Extraction BypassEPSS 0.6%CVE-2020-29023LOWCSV Formula Injection possible due to improper fields escaping in GateManagerEPSS 0.5%CVE-2023-3552HIGHImproper Encoding or Escaping of Output in nilsteampassnet/teampassEPSS 0.5%CVE-2026-55891NONEPrivateBin: Reflected JSON injection in backend responses via unescaped REQUEST_URIEPSS 0.5%CVE-2022-41322HIGHIn Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user mEPSS 0.5%CVE-2026-34479MEDIUMApache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersEPSS 0.5%CVE-2026-70609MEDIUMElectron: DevTools JavaScript Injection via Unsanitized Dock State ParameterEPSS 0.5%CVE-2023-29543HIGHAn attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vectEPSS 0.5%CVE-2026-43971MEDIUMLink Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1EPSS 0.5%CVE-2023-3190LOWImproper Encoding or Escaping of Output in nilsteampassnet/teampassEPSS 0.5%CVE-2022-43543MEDIUMKDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode controlEPSS 0.5%CVE-2025-61773HIGHpyLoad CNL and captcha handlers allow code Injection via unsanitized parametersEPSS 0.5%CVE-2021-47694MEDIUMNagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test CommandEPSS 0.5%CVE-2026-55618MEDIUMeml_parser: URL extraction bypass via HTML entities in URLsEPSS 0.5%CVE-2025-8405HIGHImproper Encoding or Escaping of Output in GitLabEPSS 0.5%