Falhas do tipo CWE-116

427 resultados

Codificação ou escape inadequado de saída

Fraqueza em que dados de saída não são codificados ou escapados corretamente antes de serem apresentados ao usuário ou processados por outro sistema. Isso permite que caracteres especiais (como <, >, aspas, Unicode) sejam interpretados como código em vez de dados literais, facilitando injeção de scripts, SQL ou outros ataques dependendo do contexto.

Exemplo

Um site que exibe um comentário do usuário sem escape HTML: se alguém enviar '<script>alert("XSS")</script>', o navegador executa o script em vez de mostrar o texto como comentário. Ou um app que insere entrada do usuário direto em comando SQL sem escape, permitindo SQL injection.

Como mitigar

Escape ou codifique a saída conforme o contexto de destino: use funções nativas de escape HTML para web (ex: `htmlspecialchars()` em PHP), prepared statements com placeholders para SQL, e bibliotecas estabelecidas como OWASP Encoder. Nunca confie em input do usuário — trate toda saída como potencialmente perigosa.

CVE-2026-88060HIGHAngular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsEPSS 0.4%CVE-2024-39682MEDIUMWordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe ExcerptEPSS 0.4%CVE-2025-32974CRITICALorg.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content typeEPSS 0.4%CVE-2026-47206LOWDragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializerEPSS 0.4%CVE-2024-47224MEDIUMA vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unEPSS 0.4%CVE-2023-45359MEDIUMAn issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label isEPSS 0.4%CVE-2026-73055MEDIUMShescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBoxEPSS 0.4%CVE-2025-6429MEDIUMIncorrect parsing of URLs could have allowed embedding of youtube.comEPSS 0.4%CVE-2023-4393MEDIUMHTML and SMTP Injection in LiquidFilesEPSS 0.4%CVE-2026-104907MEDIUMMISP: JavaScript Injection via Remote Tag ID in Event Preview Inline HandlerEPSS 0.4%CVE-2026-54506HIGHVvveb: Stored XSS via sanitizeHTML() bypass in user profile bio fieldEPSS 0.4%CVE-2026-63344HIGHRefitter: C# source injection through OpenAPI content-type map keysEPSS 0.4%CVE-2026-63346HIGHRefitter: C# source injection through OpenAPI header parameter namesEPSS 0.4%CVE-2026-33597LOWPRSD detection denial of serviceEPSS 0.3%CVE-2026-104368HIGHExport and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info FieldEPSS 0.3%CVE-2026-79952MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper EncodingEPSS 0.3%CVE-2026-113726HIGHvirtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTEPSS 0.3%CVE-2025-55903HIGHA HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize user input in the "Bill To" address field withEPSS 0.3%CVE-2026-79964MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 0.3%CVE-2026-42321HIGHGLPI has stored XSS in asset locksEPSS 0.3%