CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- python-ldappython-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination5.5 Medium
- No product listedA HTML injection vulnerability exists in Perfex CRM v3.3.1. The application fails to sanitize...8.3 High
- pyloadpyLoad CNL and captcha handlers allow code Injection via unsanitized parameters8.1 High
- logo software inc. cloudHTML Injection in Logo Software's Logo Cloud4.3 Medium
- motioneye project motioneyeDuplicate Advisory: motionEye vulnerable to RCE via unsanitized motion config parameter7.2 High
- nearform get-jwksget-jwks poisoned JWKS cache allows post-fetch issuer validation bypass9.4 Critical
- hallo welt! gmbh bluespicePotential XSS in Extension:BlueSpiceWhoIsOnline5.9 Medium
- hallo welt! gmbh bluespicePotential XSS in Extension:BlueSpiceAvatars5.9 Medium
- hallo welt! gmbh bluespicePotential XSS in Extension:AtMentions5.9 Medium
- patika global technologies humansuiteHTML Injection in Patika Global Technologies' HumanSuite4.3 Medium
- xwikisas xwiki-pro-macrosXWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro10.0 Critical
- xwikisas xwiki-pro-macrosXWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro10.0 Critical
- element-plusElement Plus Link component (el-link) implements insufficient input validation for the href attribute6.4 Medium
- avigilon access control managerA Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute...9.8 Critical
- etq reliance cg (legacy)ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`5.1 Medium
- mozilla firefox, thunderbird +1 moreIncorrect parsing of URLs could have allowed embedding of youtube.com6.5 Medium
- wilderforgeWilderForge vulnerable to code Injection via GitHub Actions Workflows10.0 Critical
- discourseDiscourse vulnerable to HTML injection when inviting to topic via email7.1 High
- ibm security guardiumIBM Security Guardium information disclosure4.9 Medium
- mozilla firefox, thunderbird +1 moreDevtools' preview ignored CSP headers6.5 Medium
- tridium niagara, niagara enterprise security, niagara framework +2 moreImproper Output Neutralization for Logs4.3 Medium
- lenovo browserYandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.6.9 Medium
- yandex browser lite, browser +1 moreYandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.8.2 High
- pure storage px backupPX Backup Improper Sanitization Vulnerability8.4 High
- umbraco forms, umbraco.forms.issues +1 moreUmbraco.Forms has HTML injection vulnerability in 'Send email' workflow2.3 Low
- radware cloud wafRadware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass...9.1 Critical
- misskeyMisskey CSS Style Injection Vulnerability In `MkUrlPreview`7.2 High
- bosch rexroth ag ctrlx os - solutionsA vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows...7.1 High
- yeswikiYesWiki Remote Code Execution via Arbitrary PHP File Write and Execution5.8 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type9.1 Critical
- mozilla firefox, thunderbird +1 morePotential local code execution in "copy as cURL" command5.7 Medium
- apache tomcatApache Tomcat: Bypass of rules in Rewrite Valve9.8 Critical
- dell powerprotect data managerDell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding...4.2 Medium
- the wikimedia foundation mediawiki - version compare extensionXSSes and potential RCE in Special:VersionCompare6.9 Medium
- the wikimedia foundation mediawiki core - feed utilsHTML injection in feed output from i18n message6.9 Medium
- the wikimedia foundation mediawiki - confirm account extensionXSSes in Extension:ConfirmAccount5.4 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: Processing of a specific BGP update causes the SRRD process to crash6.9 Medium
django-tomselectPyPIDjango TomSelect incomplete escaping of dangerous characters in widget attributes1.7 Low- intevation openslidesAn issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group...3.5 Low
- berriai berriai/litellm, litellm +1 moreImproper Output Neutralization for Logs in berriai/litellm7.5 High
- synology beestation os (bsm), beestation os, diskstation manager (dsm) +3 more +5 moreImproper encoding or escaping of output vulnerability in the webapi component in Synology...5.3 Medium
- synology beestation os (bsm), beestation os, diskstation manager (dsm) +3 more +5 moreImproper encoding or escaping of output vulnerability in the system plugin daemon in Synology...9.8 Critical
- ibm control center, sterling control center +1 moreIBM Control Center HOST header injection5.4 Medium
- google androidIn multiple locations, there is a possible way to access content across user profiles due to URI...4.0 Medium
- python software foundation cpythonMishandling of comma during folding and unicode-encoding of email headers2.3 Low
- odoo, odoo community, enterprise +2 moreImproper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0...8.1 High
- solidjs solidLack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-js7.3 High
- ryansolid dom-expressions, dom expressions +1 moreCross-site Scripting vulnerability due to improper use of string.replace in dom-expressions7.3 High
- ibm openpages with watsonIBM OpenPages log manipulation5.3 Medium
- ibm aspera sharesIBM Aspera Shares Data Manipulation5.3 Medium
- Show moreLoading…