CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- yafnetYAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header8.1 High
- apache polarisApache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names9.4 Critical
- axiosAxios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams3.7 Low
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component5.4 Medium
- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreBaseCookie.js_output() does not neutralize embedded characters2.1 Low
- uutils coreutilsuutils coreutils printenv Security Inspection Bypass via UTF-8 Enforcement4.4 Medium
- uutils coreutilsuutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization3.3 Low
- powerdns dnsdistPRSD detection denial of service3.7 Low
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API7.2 High
- freescout-help-desk freescoutFreeScout Vulnerable to XSS via Mailbox Signature Due to Incomplete HTML Sanitization8.5 High
- freescout-help-desk freescoutFreeScout has HTML Injection in Outgoing Emails via Unsanitized Customer Name in Signature Variables5.8 Medium
- zyxel wre6505 v2 firmware, wre6505 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program...4.5 Medium
- pretalxpretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates6.1 Medium
- churchcrm crmChurchCRM: Stored XSS in UserEditor.php via Login Name Field4.8 Medium
- churchcrm crmChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field5.4 Medium
- stirling-tools stirling-pdf, stirlingpdf stirling pdf +1 moreStirling-PDF: Reflected XSS through crafted filename in file upload functionality3.1 Low
- netfoundry zrokzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering6.1 Medium
- apostrophecms apostrophe, apostrophecms +1 moreApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS8.7 High
- cisco identity services engine, identity services engine software, identity services engine passive identity connector +2 moreCisco Identity Services Engine Authenticated Privilege Escalation Vulnerability6.0 Medium
- schneider electric powerchute™ serial shutdown, schneider-electric powerchute serial shutdown +1 moreCWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log...6.9 Medium
- espocrmEspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field4.6 Medium
- apache log4cxx, apache software foundation log4cxx (brew), log4cxx (conan) +2 moreApache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters6.3 Medium
- apache log4netApache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters6.3 Medium
- apache log4j, apache software foundation log4j json template layout +1 moreApache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout6.3 Medium
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters6.9 Medium
- apache log4j, apache software foundation log4j 1 to log4j 2 bridge +1 moreApache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters6.9 Medium
- apache tomcatApache Tomcat: Incomplete escaping of JSON access logs7.5 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection7.6 High
- lichess lilalichess.org has an Unsanitized Stream Title Injection on /streamer5.3 Medium
- glpi-project glpiGLPI has an Unauthenticated Stored XSS via inventory7.5 High
- glpi-project glpiGLPI has Stored XSS in Supplier 'Website' field7.2 High
- nationalsecurityagency emissaryEmissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix8.8 High
- openclawOpenClaw 2026.2.13 < 2026.3.25 - ANSI Escape Sequence Injection in Approval Prompt5.3 Medium
AWSSDK.CloudFrontNuGet,AWSSDK.Extensions.CloudFront.SignersNuGet +1 moreAWS SDK for .NET: Improper escaping of special characters in CloudFront policy document construction7.7 Highio.root.software.amazon.awssdk:cloudfrontRoot,software.amazon.awssdk:cloudfrontMaven +1 moreAWS SDK for Java 2.0: Improper Handling of Special Characters in CloudFront Signing Utilities7.7 High- handlebars-lang handlebars.js, handlebarsjs handlebars, red hat cluster observability operator 1.5.0 +11 more +13 moreHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options8.3 High
loofahRubyGemsLoofah has improper detection of disallowed URIs via `allowed_uri?`2.3 Low- openbao, red hat cryostat 4 +1 moreOpenBao has Reflected XSS in its OIDC authentication error message9.4 Critical
- invoiceninja invoice ninja, invoiceninja +1 moreInvoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items5.4 Medium
- textpattern, textpattern cms +1 moreTextpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection5.1 Medium
- suitecrmSuiteCRM has blind XSS in return_id parameter5.9 Medium
- freescoutFreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})9.3 Critical
- open-emr openemrOpenEMR has arbitrary image file read via PDF generator7.1 High
- h3js h3h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments8.2 High
- dadrus heimdallHeimdall: Path received via Envoy gRPC corrupted when containing query string8.2 High
- parall jspdf, red hat advanced cluster security 4.8, advanced cluster security 4.9 +2 morejsPDF has a PDF Object Injection via FreeText color8.1 High
- python, python software foundation cpython +1 moreIncomplete control character validation in http.cookies6.0 Medium
- vapor leafkit, leaf-kit +1 moreLeafKit's HTML escaping may be skipped for Collection values, enabling XSS6.9 Medium
- gitlabImproper Encoding or Escaping of Output in GitLab2.2 Low
- craftcms cms, craft cms +1 moreCraft has Reflective XSS via incomplete return URL sanitization6.9 Medium
- Show moreLoading…