Weakness (CWE)
CWE-116: Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
How to prevent it (7 mitigations)
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
Alternately, use built-in functions, but consider using wrappers in case those functions are discovered to have a vulnerability.
-
Architecture and Design
If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.
-
Architecture and Design, Implementation
Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies.
-
Architecture and Design
In some cases, input validation may be an important strategy when output encoding is not a complete solution. For example, you may be providing the same output that will be processed by multiple consumers that use different encodings or representations. In other cases, you may be required to allow user-supplied input to contain control information, such as limited HTML tags that support formatting in a wiki or bulletin board. When this type of requirement must be met, use an extremely strict allowlist to limit which control sequences can be used. Verify that the resulting syntactic structure is what you expect. Use your normal encoding methods for the remainder of the input.
-
Architecture and Design
Use input validation as a defense-in-depth measure to reduce the likelihood of output encoding errors (see CWE-20).
-
Requirements
Fully specify which encodings are required by components that will be communicating with each other.
-
Implementation
When exchanging data between components, ensure that both components are using the same character encoding. Ensure that the proper encoding is applied at each interface. Explicitly set the encoding you are using whenever the protocol allows you to do so.
Source: MITRE CWE-116
77 results · Clear filters · Feed
-
Critical 9.1
SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a me…
-
Critical 9.4
get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass
get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss (issuer) claim is validated only after keys are retrieved from the cache, it is …
-
Critical 10.0
XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the title in the confluence paste code macro allows remote code execution for …
-
Critical 10.0
XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Starting in version 1.0 and prior to version 1.26.5, missing escaping of the ac:type in the ConfluenceLayoutSection macro allows remote code execution …
-
Critical 9.8CVE-2025-56266 Scanner template
A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyi…
-
Critical 10.0
WilderForge vulnerable to code Injection via GitHub Actions Workflows
WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of `${{ github.event.review.body }}` and other user controlled variables dir…
-
Critical 9.1
Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by ad…
-
Critical 9.1
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15…
-
Critical 9.8CVE-2025-31651 Public exploit
Apache Tomcat: Bypass of rules in Rewrite Valve
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectivel…
-
Critical 9.8CVE-2024-10441 Public exploit
Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) befor…
-
Critical 9.8
In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This c…
-
Critical 9.4
Stored XSS in Veribilim Software's Veribase Order Management
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order all…
-
Critical 9.1
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…
KEV May 1, 2025 -
Critical 9.7
Jupyter Server Proxy has a reflected XSS issue in host parameter
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.0 have a reflected cross-site scripting (XSS) issue. The `/…
-
Critical 9.4
Command injection via array-ish $command parameter of proc_open()
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply argu…
-
Critical 9.8
Apache Zeppelin: Interpreter download command does not escape malicious code injection
Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.…
-
Critical 9.3
Django Template Engine Vulnerable to XSS
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially …
-
Critical 9.8
An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly fil…
-
Critical 9.1
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In `org.xwiki.platform:xwiki-platform-web` versions 7.2-milestone-2 until 14.10.12 and `org.xwiki.platform:xwiki-platform-web-templates` prior to versions…
-
Critical 9.1
Improper Encoding or Escaping of Output in froxlor/froxlor
Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
-
Critical 9.8
Controller stack overflow when decoding messages from the server
Controller DoS due to stack overflow when decoding a message from the server. See Honeywell Security Notification for recommendations on upgrading and versioning.
-
Critical 9.1CVE-2023-32071 EPSS 70%
XWiki Platform vulnerable to RXSS via editor parameter - importinline template
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page w…
-
Critical 9.8
ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which all…
-
Critical 9.8CVE-2022-42948 Exploited
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafte…
KEV Mar 30, 2023 -
Critical 10.0
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with certain content. This can be done by creating a new page or even through th…
-
Critical 9.9
Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-menu-ui
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading…
-
Critical 9.8
CRLF log injection
Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue.
-
Critical 9.9CVE-2022-36100 EPSS 74%
XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection
XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and prior to 13.10.6 and 14.4 in XWiki Platform Tag UI, the tags document `Main.Tag…
-
Critical 9.9CVE-2022-36099 EPSS 76%
XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability
XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 and 14.4, it's possible to inject arbitrary wiki syntax including Groovy, Python…
-
Critical 9.8
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
-
Critical 9.8
Commandline class shell injection vulnerabilities
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
-
Critical 9.8CVE-2022-25235 Public exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…
-
Critical 9.9
Code injection in iTunesRPC-Remastered
iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no…
-
Critical 9.8
Inconsistent input sanitisation leads to XSS vectors
OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host…
-
Critical 9.6
keycloak Self Stored Cross-site Scripting vulnerability
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The h…
-
Critical 9.8
Improper Input Validation in Symfony
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
-
Critical 9.8
dojox vulnerable to unescaped string injection
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.