Fallos del tipo CWE-116

427 resultados

Codificação ou escaping inadequado de saída

Ocorre quando a aplicação não codifica ou escapa corretamente dados que serão exibidos ou processados em contextos que interpretam caracteres especiais (HTML, JavaScript, SQL, URLs, etc.). Sem essa proteção, caracteres maliciosos passam intactos e podem ser interpretados como código, causando injeção ou execução não autorizada.

Ejemplo

Uma página web que exibe um comentário de usuário sem escapar tags HTML: se o atacante injeta '<script>alert(1)</script>', o navegador executa o script em vez de exibir o texto como literal. Ou um parâmetro de URL mal codificado que permite injeção SQL quando concatenado diretamente em queries.

Cómo mitigar

Sempre codifique ou escape dados de entrada antes de usá-los em contextos sensíveis: use funções nativas de encoding (ex: htmlspecialchars() em PHP, DOMPurify em JavaScript, parametrized queries em SQL). Escolha o tipo certo de encoding para cada contexto (HTML, URL, JavaScript, CSS) — não use o mesmo para todos.

CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.5%CVE-2024-9348HIGHDocker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build viewEPSS 0.5%CVE-2026-34483HIGHApache Tomcat: Incomplete escaping of JSON access logsEPSS 0.5%CVE-2026-63470CRITICALfastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstringEPSS 0.5%CVE-2026-82681LOWQuery-parameter injection in AshAdmin row-action links via unencoded string primary keysEPSS 0.5%CVE-2025-36254HIGHDS8900F and DS8A00 Authentication BypassEPSS 0.5%CVE-2026-33301HIGHOpenEMR has arbitrary image file read via PDF generatorEPSS 0.5%CVE-2026-81522HIGHCross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ DriverEPSS 0.5%CVE-2023-2200MEDIUMImproper Encoding or Escaping of Output in GitLabEPSS 0.5%CVE-2024-6329MEDIUMImproper Encoding or Escaping of Output in GitLabEPSS 0.5%CVE-2025-61912MEDIUMpython-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null TerminationEPSS 0.5%CVE-2021-25262MEDIUMYandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.EPSS 0.5%CVE-2023-39390—Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerabilityEPSS 0.4%CVE-2023-39381— Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart.EPSS 0.4%CVE-2023-39386—Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newEPSS 0.4%CVE-2023-39382— Input verification vulnerability in the audio module. Successful exploitation of this vulnerability may cause virtual machines (VMs) to resEPSS 0.4%CVE-2025-4084MEDIUMPotential local code execution in "copy as cURL" commandEPSS 0.4%CVE-2025-64325HIGHEmby Server is Vulnerable to Remote Code Execution Through XSS in Admin DashboardEPSS 0.4%CVE-2026-73157LOWcti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event MetadataEPSS 0.4%CVE-2024-35225CRITICALJupyter Server Proxy has a reflected XSS issue in host parameterEPSS 0.4%