# CWE-116. Every Advisory and CVE whose sources give the weakness CWE-116, newest first. ## Records, newest first (an older page) - [LibreNMS vulnerable to Stored Cross-site Scripting via File Upload](https://agentprime.io/advisories/GHSA-x8gm-j36p-fppf.md) `GHSA-x8gm-j36p-fppf`, `CVE-2024-47528`, `PKSA-n7p4-zf3z-2mtf` · Packagist `librenms/librenms`: affected `<24.9.0`, fixed in `24.9.0` · CVSS 4.6 Medium · Not analysed yet · Published 1 Oct 2024 · Tags: Cross-site scripting (XSS), Unrestricted file upload, CWE-116 - [Scout contains insufficient output escaping of attachment names](https://agentprime.io/advisories/CVE-2024-47531.md) `CVE-2024-47531` · CVE record: Clinical-Genomics scout · CVSS 4.6 Medium · Not analysed yet · Published 30 Sept 2024 · Tags: CWE-116 - [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2024-4099.md) `CVE-2024-4099` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-116 - [Stored XSS in Veribilim Software's Veribase Order Management](https://agentprime.io/advisories/CVE-2024-7873.md) `CVE-2024-7873` · CVE record: Veribilim Software Veribase Order · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2024 · Tags: Cross-site scripting (XSS), CWE-116 - [Apache Airflow vulnerable to Improper Encoding or Escaping of Output](https://agentprime.io/advisories/GHSA-c392-whpc-vfpr.md) `GHSA-c392-whpc-vfpr`, `BIT-airflow-2024-45498`, `CVE-2024-45498`, `PYSEC-2024-266` · PyPI `apache-airflow`: affected `>=2.10.0, <2.10.1`, fixed in `2.10.1` · CVSS 8.8 High · Not analysed yet · Published 7 Sept 2024 · Tags: CWE-116 - [alf.io's preloaded data as json is not escaped correctly](https://agentprime.io/advisories/CVE-2024-45299.md) `CVE-2024-45299` · CVE record: alfio-event alf.io · CVSS 6.5 Medium · Not analysed yet · Published 6 Sept 2024 · Tags: CWE-116 - [Improper output encoding in Google Android](https://agentprime.io/advisories/CVE-2024-34739.md) `CVE-2024-34739` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 15 Aug 2024 · Tags: CWE-116 - [Windows App Installer Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-38177.md) `CVE-2024-38177` · CVE record: Microsoft App Installer · CVSS 7.8 High · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-116 - [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2024-6329.md) `CVE-2024-6329` · CVE record: GitLab GitLab · CVSS 5.7 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: CWE-116 - [WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt](https://agentprime.io/advisories/CVE-2024-39682.md) `CVE-2024-39682` · CVE record: XjSv Cooked · CVSS 6.4 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: CWE-116 - [Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable a…](https://agentprime.io/advisories/CVE-2024-39929.md) `CVE-2024-39929` · CVE record · CVSS 5.4 Medium · EPSS 0.41 · Not analysed yet · Published 4 Jul 2024 · Tags: CWE-116 - [Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.](https://agentprime.io/advisories/CVE-2024-38475.md) `CVE-2024-38475` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.1 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-116 - [Apache HTTP Server weakness with encoded question marks in backreferences](https://agentprime.io/advisories/CVE-2024-38474.md) `CVE-2024-38474` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.1 High · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-116 - [Apache HTTP Server proxy encoding problem](https://agentprime.io/advisories/CVE-2024-38473.md) `CVE-2024-38473` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-116 - [An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected into a system call when certain types of c…](https://agentprime.io/advisories/CVE-2024-27629.md) `CVE-2024-27629` · CVE record · CVSS 7.8 High · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-116 - [Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4...](https://agentprime.io/advisories/GHSA-fvcq-4x64-hqxr.md) `GHSA-fvcq-4x64-hqxr`, `CVE-2024-35225`, `PYSEC-2024-236` · PyPI `jupyter-server-proxy`: affected `>=3.0.0, <3.2.4 || >=4.1.2, <4.2.0`, fixed in `3.2.4`, `4.2.0` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2024 · Tags: Cross-site scripting (XSS), CWE-116 - [Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)](https://agentprime.io/advisories/CVE-2024-5585.md) `CVE-2024-5585` · CVE record: PHP Group PHP · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 9 Jun 2024 · Tags: Command injection, CWE-116 - [Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)](https://agentprime.io/advisories/CVE-2024-4177.md) `CVE-2024-4177` · CVE record: Bitdefender GravityZone Console On-Premise · CVSS 8.1 High · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-116 - [Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability](https://agentprime.io/advisories/GHSA-8cm5-jfj2-26q7.md) `GHSA-8cm5-jfj2-26q7`, `CVE-2024-34715`, `PYSEC-2026-1337` · PyPI `ethyca-fides`: affected `<2.37.0`, fixed in `2.37.0` · CVSS 2.3 Low · Not analysed yet · Published 29 May 2024 · Tags: Information disclosure, CWE-116 - [Denial of Service in Tink-cc](https://agentprime.io/advisories/CVE-2024-4420.md) `CVE-2024-4420` · CVE record: Google Tink and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 21 May 2024 · Tags: CWE-116 - [TYPO3 vulnerable to an HTML Injection in the History Module](https://agentprime.io/advisories/GHSA-xjwx-78x7-q6jc.md) `GHSA-xjwx-78x7-q6jc`, `CVE-2024-34355`, `PKSA-7dr7-npxr-1nyj` · Packagist `typo3/cms-core`: affected `>=13.0.0, <13.1.1`, fixed in `13.1.1` · CVSS 3.5 Low · Not analysed yet · Published 14 May 2024 · Tags: Cross-site scripting (XSS), CWE-116 - [Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API](https://agentprime.io/advisories/CVE-2024-29894.md) `CVE-2024-29894` · CVE record: Cacti cacti · CVSS 5.4 Medium · Not analysed yet · Published 13 May 2024 · Tags: Cross-site scripting (XSS), CWE-116 - [Gradio before 4.20 allows credential leakage on Windows.](https://agentprime.io/advisories/GHSA-rvfh-h6c7-fc3c.md) `GHSA-rvfh-h6c7-fc3c`, `CVE-2024-34510`, `PYSEC-2024-255` · PyPI `gradio`: affected `<4.20.0`, fixed in `4.20.0` · CVSS 7.5 High · Not analysed yet · Published 5 May 2024 · Tags: CWE-116 - [Command injection via array-ish $command parameter of proc_open()](https://agentprime.io/advisories/CVE-2024-1874.md) `CVE-2024-1874` · CVE record: PHP Group PHP · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 29 Apr 2024 · Tags: CWE-116 - [Apache Zeppelin vulnerable to cross-site scripting in the helium module](https://agentprime.io/advisories/GHSA-rrvf-5w4r-3x7v.md) `GHSA-rrvf-5w4r-3x7v`, `CVE-2024-31868` · Maven `org.apache.zeppelin:zeppelin-interpreter`: affected `>=0.8.2, <0.11.1`, fixed in `0.11.1` · CVSS 6.1 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Cross-site scripting (XSS), CWE-116 - [Improper escaping in Apache Zeppelin](https://agentprime.io/advisories/GHSA-86jx-wr74-xr74.md) `GHSA-86jx-wr74-xr74`, `CVE-2024-31866` · Maven `org.apache.zeppelin:zeppelin-interpreter`: affected `>=0.8.2, <0.11.1`, fixed in `0.11.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-116 - [KaTeX's \`\includegraphics\` does not escape filename](https://agentprime.io/advisories/GHSA-f98w-7cxr-ff2h.md) `GHSA-f98w-7cxr-ff2h`, `CVE-2024-28245` · npm `katex`: affected `>=0.11.0, <0.16.10`, fixed in `0.16.10` · CVSS 6.3 Medium · Not analysed yet · Published 25 Mar 2024 · Tags: CWE-116 - [Information leakage in YAQL](https://agentprime.io/advisories/GHSA-mvf6-hwxh-7v76.md) `GHSA-mvf6-hwxh-7v76`, `CVE-2024-29156`, `PYSEC-2026-2059` · PyPI `yaql`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 18 Mar 2024 · Tags: Information disclosure, CWE-116 - [SMTP Smuggling in Postal](https://agentprime.io/advisories/CVE-2024-27938.md) `CVE-2024-27938` · CVE record: postalserver postal · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2024 · Tags: CWE-116 - [Multiple issues involving quote API](https://agentprime.io/advisories/GHSA-r7qv-8r2h-pg27.md) `GHSA-r7qv-8r2h-pg27`, `CVE-2024-58266`, `RUSTSEC-2024-0006` · crates.io `shlex`: affected `>=0.0.0-0, <1.3.0`, fixed in `1.3.0` · CVSS 3.2 Low · Not analysed yet · Published 21 Jan 2024 · Tags: CWE-116 - [Improper input validation in Intel NUC BIOS firmware](https://agentprime.io/advisories/CVE-2023-28738.md) `CVE-2023-28738` · CVE record: Intel NUC BIOS firmware · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2024 · Tags: CWE-20, CWE-116 - [Improper output encoding in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-52102.md) `CVE-2023-52102` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jan 2024 · Tags: CWE-116 - [Uncontrolled resource consumption in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-52098.md) `CVE-2023-52098` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.5 High · Not analysed yet · Published 16 Jan 2024 · Tags: Denial of service, CWE-116 - [Django Template Engine Vulnerable to XSS](https://agentprime.io/advisories/GHSA-4mq2-gc4j-cmw6.md) `GHSA-4mq2-gc4j-cmw6`, `CVE-2024-22199`, `GO-2024-2461` · Go `github.com/gofiber/template/django/v3`: affected `<3.1.9`, fixed in `3.1.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jan 2024 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116 - [lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.](https://agentprime.io/advisories/CVE-2023-42183.md) `CVE-2023-42183` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: CWE-116 - [HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end r…](https://agentprime.io/advisories/CVE-2023-45539.md) `CVE-2023-45539` · CVE record · CVSS 8.2 High · Not analysed yet · Published 28 Nov 2023 · Tags: CWE-116 - [IBM QRadar WinCollect Agent improper output encoding](https://agentprime.io/advisories/CVE-2023-26279.md) `CVE-2023-26279` · CVE record: IBM QRadar WinCollect Agent · CVSS 3.3 Low · Not analysed yet · Published 23 Nov 2023 · Tags: CWE-116 - [An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.](https://agentprime.io/advisories/CVE-2023-48655.md) `CVE-2023-48655` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Nov 2023 · Tags: CWE-116 - [Mattermost password hash disclosure vulnerability](https://agentprime.io/advisories/GHSA-r67m-mf7v-qp7j.md) `GHSA-r67m-mf7v-qp7j`, `CVE-2023-5968` · Go `github.com/mattermost/mattermost-server` and 3 more: affected `<5.3.2-0.20230825233148-f787fd63368a`, fixed in `5.3.2-0.20230825233148-f787fd63368a` · CVSS 4.9 Medium · Not analysed yet · Published 6 Nov 2023 · Tags: Information disclosure, CWE-116 - [HTML and SMTP Injection in LiquidFiles](https://agentprime.io/advisories/CVE-2023-4393.md) `CVE-2023-4393` · CVE record: LiquidFiles Pty Ltd LiquidFiles · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2023 · Tags: CWE-116, CWE-147 - [XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title](https://agentprime.io/advisories/GHSA-ghf6-2f42-mjh9.md) `GHSA-ghf6-2f42-mjh9`, `CVE-2023-45135` · Maven `org.xwiki.platform:xwiki-platform-web` and 1 more: affected `>=7.2-milestone-2, <14.10.12`, fixed in `14.10.12` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-116 - [React Developer Tools extension Improper Authorization vulnerability](https://agentprime.io/advisories/GHSA-rxrc-rgv4-jpvx.md) `GHSA-rxrc-rgv4-jpvx`, `CVE-2023-5654` · npm `react-devtools-core`: affected `<4.28.4`, fixed in `4.28.4` · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2023 · Tags: Broken access control, CWE-116 - [Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device](https://agentprime.io/advisories/GHSA-364c-vvqx-446c.md) `GHSA-364c-vvqx-446c`, `CVE-2023-43620`, `GO-2023-2068` · Go `github.com/schollz/croc/v9`: affected `<9.6.16`, fixed in `9.6.16` · CVSS 7.8 High · Not analysed yet · Published 20 Sept 2023 · Tags: CWE-116 - [Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0](https://agentprime.io/advisories/CVE-2023-37875.md) `CVE-2023-37875` · CVE record: Wing FTP Server Wing FTP Server · CVSS 3.0 Low · Not analysed yet · Published 12 Sept 2023 · Tags: CWE-116 - [Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (v…](https://agentprime.io/advisories/CVE-2023-40453.md) `CVE-2023-40453` · CVE record · No CVSS score · Not analysed yet · Published 14 Aug 2023 · Tags: CWE-116 - [Improper input validation in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39390.md) `CVE-2023-39390` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-20, CWE-116 - [Buffer overflow in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39386.md) `CVE-2023-39386` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: Memory corruption, CWE-116 - [Improper input validation in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39382.md) `CVE-2023-39382` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-20, CWE-116 - [Improper input validation in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2023-39381.md) `CVE-2023-39381` · CVE record: Huawei HarmonyOS and 1 more · No CVSS score · Not analysed yet · Published 13 Aug 2023 · Tags: CWE-20, CWE-116 - [OpenZeppelin Contracts vulnerable to Improper Escaping of Output](https://agentprime.io/advisories/GHSA-g4vp-m682-qqmp.md) `GHSA-g4vp-m682-qqmp`, `CVE-2023-40014` · npm `@openzeppelin/contracts` and 1 more: affected `>=4.0.0, <4.9.3`, fixed in `4.9.3` · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2023 · Tags: CWE-116 - [Critters Cross-site Scripting Vulnerability](https://agentprime.io/advisories/GHSA-cx3j-qqxj-9597.md) `GHSA-cx3j-qqxj-9597`, `CVE-2023-3481` · npm `critters`: affected `>=0.0.17, <0.0.20`, fixed in `0.0.20` · CVSS 5.7 Medium · Not analysed yet · Published 11 Aug 2023 · Tags: Cross-site scripting (XSS), CWE-116 - [Improper input validation in Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME](https://agentprime.io/advisories/CVE-2022-36392.md) `CVE-2022-36392` · CVE record: Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME · CVSS 8.6 High · Not analysed yet · Published 11 Aug 2023 · Tags: CWE-20, CWE-116 - [PrestaShop XSS injection through Validate::isCleanHTML method](https://agentprime.io/advisories/GHSA-xw2r-f8xv-c8xp.md) `GHSA-xw2r-f8xv-c8xp`, `CVE-2023-39527`, `PKSA-fd9b-yzvb-7sj4` · Packagist `prestashop/prestashop`: affected `<1.7.8.10 || >=8.0.0, <8.0.5 || >=8.1.0, <8.1.1`, fixed in `1.7.8.10`, `8.0.5`, `8.1.1` · CVSS 8.3 High · Not analysed yet · Published 9 Aug 2023 · Tags: Cross-site scripting (XSS), CWE-116 - [Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed.](https://agentprime.io/advisories/CVE-2022-43713.md) `CVE-2022-43713` · CVE record · No CVSS score · Not analysed yet · Published 26 Jul 2023 · Tags: CWE-116 - [Envoy vulnerable to OAuth2 credentials exploit with permanent validity](https://agentprime.io/advisories/CVE-2023-35941.md) `CVE-2023-35941` · CVE record: envoyproxy envoy · CVSS 8.6 High · Not analysed yet · Published 25 Jul 2023 · Tags: CWE-116 - [Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax](https://agentprime.io/advisories/GHSA-7m5c-fgwf-mwph.md) `GHSA-7m5c-fgwf-mwph`, `CVE-2023-34036` · Maven `org.springframework.hateoas:spring-hateoas`: affected `<1.5.5 || >=2.0.0, <2.0.5 || >=2.1.0, <2.1.1`, fixed in `1.5.5`, `2.0.5`, `2.1.1` · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: CWE-116, CWE-644 - [Froxlor vulnerable to Improper Encoding or Escaping of Output](https://agentprime.io/advisories/GHSA-c6v5-pf66-xfq8.md) `GHSA-c6v5-pf66-xfq8`, `CVE-2023-3668`, `PKSA-65v9-z1rw-mzb5` · Packagist `froxlor/froxlor`: affected `<2.0.21`, fixed in `2.0.21` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2023 · Tags: CWE-116 - [Controller stack overflow when decoding messages from the server](https://agentprime.io/advisories/CVE-2023-24480.md) `CVE-2023-24480` · CVE record: Honeywell C300 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-116 - [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2023-2200.md) `CVE-2023-2200` · CVE record: GitLab GitLab · CVSS 4.1 Medium · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-116 - [TeamPass vulnerable to Improper Encoding or Escaping of Output](https://agentprime.io/advisories/GHSA-2cv5-qvq3-6276.md) `GHSA-2cv5-qvq3-6276`, `CVE-2023-3552`, `PKSA-771w-4gkn-c7y4` · Packagist `nilsteampassnet/teampass`: affected `<3.0.10`, fixed in `3.0.10` · CVSS 7.6 High · Not analysed yet · Published 8 Jul 2023 · Tags: CWE-116 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .