CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- fatpipe warpWarp: OS command injection when opening terminal links from WSL7.7 High
- apache nifiApache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL5.2 Medium
- @openzeppelin wizard, wizard-cairo, wizard-stellar +2 more +4 moreOpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source3.3 Low
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser9.3 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text4.8 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates8.7 High
- dadrus heimdallHeimdall: IP Spoofing via Unvalidated Forwarding Headers7.0 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +14 more +16 more.NET Spoofing Vulnerability6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Stored XSS to Account Takeover via Model Profile Images in Open WebUI7.6 High
- flarum frameworkCRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay8.9 High
- caddyserver caddyCaddy: stripHTML template function bypass4.2 Medium
- honojs honoHono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice5.3 Medium
- fabricjs fabric.jsFabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization5.4 Medium
- apple swift-nio-http2, swiftnio http\/2 +1 moreSwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec5.3 Medium
grumpydictator/firefly-iiiPackagistFirefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)5.1 Medium- jmespath, jmespath jmespath.php +1 morejmespath.php has CompilerRuntime code injection via unescaped function names9.8 Critical
- duck-organization questbotQuest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.2.1 Low
- duck-organization quest-botQuest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.2.3 Low
- duck-organization quest-botQuest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings2.3 Low
- duck-organization quest-botQuest Bot: Ticket reason allows mass-mention injection6.3 Medium
- duck-organization quest-botQuest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`8.8 High
- juev nebula-meshnebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)5.5 Medium
- xibosignage xibo-cmsXibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet7.6 High
- misp bsimvisMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels6.9 Medium
- freeswitchFreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat5.3 Medium
- rapid7 velociraptorA YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7...7.8 High
- cisco catalyst sd-wan manager, catalyst sd-wan controller, sd-wan vsmart controller +2 moreCisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability7.8 High
- glpi-project glpiGLPI has stored XSS in asset locks8.4 High
- elixir-tesla teslaCRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection2.1 Low
- otrs, otrs ag ((otrs)) community edition +1 moreReflected XSS in authenticated agent context7.1 High
- mcdope pam usbpam_usb: Command injection via $TMUX environment variable leads to RCE as root8.8 High
- carrierwave project carrierwaveCarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters4.7 Medium
- nousresearch hermes-agentNousResearch hermes-agent Slack Agent/Mattermost Agent escape output6.9 Medium
- symfony twig, twig cssinliner-extra, markdown-extra +2 moreTwig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`5.1 Medium
- symfony twigTwig: The `spaceless` filter implicitly marks its output as safe5.1 Medium
- cryptpadCryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS6.1 Medium
- convoypanel panelCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output4.8 Medium
- go-gitgo-git: Improper single-quote escaping in go-git SSH transport2.3 Low
- haxtheweb video-player, haxcms-nodejs +1 moreHAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft9.3 Critical
- apostrophecms apostropheApostrophe has stored XSS via javascript: URL in Image Widget Link7.3 High
- siyuan-note siyuanSiYuan: Bazaar marketplace renders unescaped package `name` and `version` metadata, allowing stored XSS and Electron code execution9.0 Critical
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and...8.1 High
- datadog guarddogGuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content5.0 Medium
- honoHono: CSS Declaration Injection via Style Object Values in JSX SSR4.3 Medium
- siyuan-note siyuanSiYuan: URL-encoded title bypasses `escapeAriaLabel`, decoded by `decodeURIComponent` into a tooltip-XSS9.4 Critical
- lfprojects mcp registry, modelcontextprotocol registry +1 moreMCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`5.1 Medium
- lin-snow ech0Ech0 before 4.7.3 Stored XSS via RSS feed tag names4.8 Medium
- go standard library html/template, golang go +1 moreEscaper bypass leads to XSS in html/template6.1 Medium
- thorsten phpmyfaqphpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering8.3 High
- yafnetYAF.NET: Stored XSS in Forum Thread Posts/Replies Allowing Arbitrary JavaScript Execution for All Thread Viewers7.3 High
- Show moreLoading…