CWE-116.

Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

• zammad
• Cross-site scripting (XSS)
• CWE-116

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

• CWE-116

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

• CWE-116

fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

• koxudaxi fastapi-code-generator
• Code injection
• CWE-116

fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

• koxudaxi fastapi-code-generator
• Code injection
• CWE-116

fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

• koxudaxi fastapi-code-generator
• Code injection
• CWE-116

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

• Code injection
• CWE-116

<1.0.1 · fixed in 1.0.1

Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

• WSO2 API Manager
• WSO2 Identity Server
• CWE-116

Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

• Apache Software Foundation Apache Wicket
• CWE-116

Refitter: C# source injection through OpenAPI header parameter names

• christianhelle refitter
• Code injection
• CWE-116

Refitter: C# source injection through OpenAPI content-type map keys

• christianhelle refitter
• Code injection
• CWE-116

Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field

• webtoffee Export and Import Users and Customers
• CWE-116

Seroval: Script injection through RegExp sources in serialized output

• Cross-site scripting (XSS)
• CWE-116

<1.0.0 || >=1.5.5, <1.6.10 · fixed in 1.0.0, 1.6.10

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

• Cross-site scripting (XSS)
• CWE-116

>=9.0.0-beta.10, <11.4.14 || >=12.0.0-alpha.1, <12.0.0-alpha.5 · fixed in 11.4.14, 12.0.0-alpha.5

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

• Cross-site scripting (XSS)
• CWE-116

>=11.1.10, <11.4.14 || >=12.0.0-alpha.4, <12.0.0-alpha.5 · fixed in 11.4.14, 12.0.0-alpha.5

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

• Other injection
• CWE-116

>=0.6.0, <0.8.2 · fixed in 0.8.2

Satori-generated SVG has improper escaping

• CWE-116

>=0.0.27, <0.33.5 · fixed in 0.33.5

qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

• ljharb qs
• CWE-116

OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

• openpanel
• CWE-116

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

• CWE-41
• CWE-116

<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3 · fixed in 2.4.8, 3.1.9, 4.2.3

Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

• intranda goobi-viewer-core
• CWE-20
• CWE-116

Vitest: Code injection via unauthenticated manual mock registration

• Code injection
• Authentication bypass

>=2.1.0-beta.7, <4.1.12 || >=5.0.0-beta.1, <5.0.3 · fixed in 4.1.12, 5.0.3

Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

• MongoDB Compass
• CWE-116

virtualenv bash activate runs commands from an environment name with a backslash before $

• Command injection
• CWE-116

<21.14.7 · fixed in 21.14.7

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

• Command injection
• CWE-116

<21.14.4 · fixed in 21.14.4

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

• Command injection
• CWE-116

<21.14.2 · fixed in 21.14.2

HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

• HappyForms
• CWE-116

Stanza injection in XMPP chat

• Mozilla Thunderbird
• CWE-116

ApostropheCMS: CAPTCHA response token not URL-encoded

• CWE-116

<1.5.5 · fixed in 1.5.5

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

• Cross-site scripting (XSS)
• CWE-116

>=3.0.0, <3.2.11 · fixed in 3.2.11

Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

• CWE-116

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

• CWE-116

swoosh has email-derived URL path injection in Microsoft Graph endpoint

• Denial of service
• CWE-116

>=1.12.0, <1.26.3 · fixed in 1.26.3

Improper Encoding or Escaping of Output in Crafty Controller

• Arcadia Technology, LLC Crafty Controller
• CWE-116

Vitess vttablet /twopcz reflected XSS

• Cross-site scripting (XSS)
• CWE-116

<0.23.5 || >=0.24.0, <0.24.2 · fixed in 0.23.5, 0.24.2

unstructured: Stored XSS via unescaped HTML generation

• Cross-site scripting (XSS)
• CWE-116

<0.24.1 · fixed in 0.24.1

BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

• MicroPyramid BottleCRM
• CWE-116

NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution

• NetBird
• Command injection
• CWE-116

Visual Studio Code Remote Code Execution Vulnerability

• Microsoft Visual Studio Code
• CWE-116

Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

• Progress ShareFile Storage Zones Controller
• Authentication bypass
• Server-side request forgery (SSRF)

Contao: Cross-site scripting in the comments bundle

• Cross-site scripting (XSS)
• CWE-116

>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12

MariaDB: privilege escalation via incorrect view frm parsing

• MariaDB server
• CWE-116
• CWE-144

FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

• freescout
• Cross-site scripting (XSS)
• CWE-116

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

• Code injection
• CWE-116

<4.6.78 · fixed in 4.6.78

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

• CWE-116

>=4.0.0, <4.7.10 · fixed in 4.7.10

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

• CWE-116
• CWE-693

<4.6.78 · fixed in 4.6.78

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

• Cross-site scripting (XSS)
• CWE-116

<3.3.0 · fixed in 3.3.0

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

• Cross-site scripting (XSS)
• CWE-116

<2.22.0 · fixed in 2.22.0

Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

• Apache Software Foundation Apache log4net
• CWE-116

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

• Code injection
• CWE-116

<0.29.1 · fixed in 0.29.1

@vue/server-renderer: XSS via missing CR in attribute-name blacklist

• Cross-site scripting (XSS)
• CWE-116

<3.5.42 || >=3.6.0-rc.0, <3.6.0-rc.6 · fixed in 3.5.42, 3.6.0-rc.6

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

• Command injection
• Code injection

>=0.1.0, <0.1.7 · fixed in 0.1.7

MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler

• MISP
• Cross-site scripting (XSS)
• CWE-116

Improper output encoding in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• CWE-116

Improper output encoding in Google Chrome

• Google Chrome
• CWE-116

fast-uri vulnerable to authority injection via an unvalidated port in serialize

• CWE-116

<2.4.6 || >=3.0.0, <3.1.7 || >=4.0.0, <4.1.4 · fixed in 2.4.6, 3.1.7, 4.1.4

Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements

• Cross-site scripting (XSS)
• CWE-116

<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4 · fixed in 20.3.30, 21.2.22, 22.1.4

GLPI: Stored XSS in suppliers

• glpi
• CWE-116

Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

• zammad
• Information disclosure
• CWE-116

xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

• Cross-site scripting (XSS)
• CWE-116

<0.4.3 · fixed in 0.4.3