CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Also known as Output Sanitization, Output Validation, Output Encoding.
A kind of CWE-707 Improper Neutralization.
From the CWE List. © The MITRE Corporation.
Newest
- ibm ds8900f (r9.4), ds8900f firmware, ds8a00 (r10.0 - r10.1) +1 more +3 moreDS8900F and DS8A00 Authentication Bypass7.4 High
- orval-labs orvalOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli9.3 Critical
- orval-labs orvalOrval: Import-time RCE via array-items default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header-parameter default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)9.3 Critical
- foremForem: Stored XSS in Admin Abuse Report Rendering6.3 Medium
- ninenines cowlibLink Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/16.3 Medium
- ericcornelissen shescapeShescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox6.3 Medium
- byron dua-clidua-cli Terminal Escape Sequence Injection via Marked Paths4.8 Medium
- dundee gdugdu Terminal Injection via Unstripped Escape Sequences4.8 Medium
- hcl aionHCL AION is affected by multiple security vulnerabilities.3.4 Low
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Encoding or Escaping of Output (CWE-116)5.4 Medium
- @swc html, swc-project swc, swc html minifier +2 moreSWC HTML minifier may allow script element breakout when minifying embedded JSON6.1 Medium
- misp cti-transmutecti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting5.1 Medium
- misp cti-transmutecti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata2.3 Low
- gnu cpioImproper Output Encoding in GNU cpio4.6 Medium
- electronElectron: DevTools JavaScript Injection via Unsanitized Dock State Parameter5.7 Medium
- gladinet centrestackCentreStack < 17.4 Session Injection via SelectProvider.aspx6.9 Medium
- arnog mathlivemathlive's Lack of Escaping of HTML allows for XSS6.3 Medium
- so-fancy diff-so-fancyTerminal Escape Injection in diff‑so‑fancy4.8 Medium
- ericcornelissen shescapeShescape: Home-directory disclosure in assignment context on Unix with Dash6.3 Medium
Magick.NET-Q16-AnyCPUNuGet,Magick.NET-Q16-arm64NuGet,Magick.NET-Q16-HDRI-AnyCPUNuGet +14 more +16 moreImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-257975.7 Medium- loytec lweb-802Loytec LWEB802: Reflected Cross-Site Scripting in LWEB8028.7 High
- loytec l-dali, l-gate, l-inx +5 more +7 moreLoytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server8.7 High
- jupyterlabJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)8.6 High
- withastro astroAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands2.1 Low
- No product listedAn issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and...9.1 Critical
- remorses genqlremorses/genql code injection7.1 High
- red hat confidential compute attestation, openshift container platform 4, openshift container platform 4.12 +11 more +13 moreGithub.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env7.8 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Code Injection via API deployment generator8.5 High
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Improper Encoding or Escaping of Output (CWE-116)9.1 Critical
facturascripts/facturascriptsPackagistFacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`3.5 Low- hedgedocHedgeDoc: Stored HTML injection via email local-part5.1 Medium
- openwrt luci-app-banipluci-app-banip Log Monitor IP Extraction Bypass8.7 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Prompt Injection Defense Bypass8.7 High
- apache log4j, apache software foundation log4j api +1 moreApache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()6.3 Medium
- gristlabs grist-coreGrist: XSS through unsafe value interpolation in server-rendered pages7.7 High
- siyuan-note siyuanSiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)8.6 High
- yeswikiYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)5.5 Medium
- honoHono: Server-Side XSS via JSX Escaping Bypass in cx() Utility6.1 Medium
ramacrates.iorama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path3.7 Low- swooshEmail-derived URL path injection in the Swoosh Microsoft Graph adapter2.1 Low
- elastic kibanaImproper Output Neutralization for Logs in Kibana Leading to Log Injection8.0 High
- dragonflydb dragonflyDragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer2.3 Low
- emilstenstrom justhtmljusthtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span5.3 Medium
- powerdns dnsdistPrometheus denial of service via crafted DNS queries3.7 Low
- siyuan-note siyuanSiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)9.0 Critical
- Show moreLoading…