Falhas do tipo CWE-116

371 resultados

Codificação ou escape inadequado de saída

Fraqueza em que dados de saída não são codificados ou escapados corretamente antes de serem apresentados ao usuário ou processados por outro sistema. Isso permite que caracteres especiais (como <, >, aspas, Unicode) sejam interpretados como código em vez de dados literais, facilitando injeção de scripts, SQL ou outros ataques dependendo do contexto.

Exemplo

Um site que exibe um comentário do usuário sem escape HTML: se alguém enviar '<script>alert("XSS")</script>', o navegador executa o script em vez de mostrar o texto como comentário. Ou um app que insere entrada do usuário direto em comando SQL sem escape, permitindo SQL injection.

Como mitigar

Escape ou codifique a saída conforme o contexto de destino: use funções nativas de escape HTML para web (ex: `htmlspecialchars()` em PHP), prepared statements com placeholders para SQL, e bibliotecas estabelecidas como OWASP Encoder. Nunca confie em input do usuário — trate toda saída como potencialmente perigosa.

CVE-2026-12047MEDIUMpgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textEPSS 0.2%CVE-2026-48209HIGHReflected XSS in authenticated agent contextEPSS 0.2%CVE-2026-84655MEDIUMJenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST APIEPSS 0.2%CVE-2026-42040LOWAxios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsEPSS 0.2%CVE-2026-13407MEDIUMRoyal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification EmailsEPSS 0.2%CVE-2023-26279LOWIBM QRadar WinCollect Agent improper output encodingEPSS 0.2%CVE-2026-34246MEDIUMCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML OutputEPSS 0.2%CVE-2026-25230MEDIUMFileRise affected by HTML Injection using color property in file tagsEPSS 0.2%CVE-2026-45011HIGHApostrophe has stored XSS via javascript: URL in Image Widget LinkEPSS 0.2%CVE-2026-79952MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper EncodingEPSS 0.2%CVE-2026-40302MEDIUMzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingEPSS 0.2%CVE-2026-54705MEDIUMmathlive's Lack of Escaping of HTML allows for XSSEPSS 0.2%CVE-2026-73055MEDIUMShescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBoxEPSS 0.2%CVE-2026-79964MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper NeutraliEPSS 0.2%CVE-2024-27629HIGHAn issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaEPSS 0.2%CVE-2026-58504MEDIUMdraw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642EPSS 0.2%CVE-2026-54893LOWEmail-derived URL path injection in the Swoosh Microsoft Graph adapterEPSS 0.2%CVE-2026-40593MEDIUMChurchCRM: Stored XSS in UserEditor.php via Login Name FieldEPSS 0.2%CVE-2026-43939HIGHYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread ViewersEPSS 0.2%CVE-2026-52772MEDIUMYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)EPSS 0.2%