CWE-116.

LibreNMS vulnerable to Stored Cross-site Scripting via File Upload

• Cross-site scripting (XSS)
• Unrestricted file upload

<24.9.0 · fixed in 24.9.0

Scout contains insufficient output escaping of attachment names

• Clinical-Genomics scout
• CWE-116

Improper Encoding or Escaping of Output in GitLab

• GitLab
• CWE-116

Stored XSS in Veribilim Software's Veribase Order Management

• Veribilim Software Veribase Order
• Cross-site scripting (XSS)
• CWE-116

Apache Airflow vulnerable to Improper Encoding or Escaping of Output

• CWE-116

>=2.10.0, <2.10.1 · fixed in 2.10.1

alf.io's preloaded data as json is not escaped correctly

• alfio-event alf.io
• CWE-116

Improper output encoding in Google Android

• Google Android
• CWE-116

Windows App Installer Spoofing Vulnerability

• Microsoft App Installer
• CWE-116

Improper Encoding or Escaping of Output in GitLab

• GitLab
• CWE-116

WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt

• XjSv Cooked
• CWE-116

Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable a…

• CWE-116

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

• Apache Software Foundation Apache HTTP Server
• CWE-116

Apache HTTP Server weakness with encoded question marks in backreferences

• Apache Software Foundation Apache HTTP Server
• CWE-116

Apache HTTP Server proxy encoding problem

• Apache Software Foundation Apache HTTP Server
• CWE-116

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected into a system call when certain types of c…

• CWE-116

Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4...

• Cross-site scripting (XSS)
• CWE-116

>=3.0.0, <3.2.4 || >=4.1.2, <4.2.0 · fixed in 3.2.4, 4.2.0

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

• PHP
• Command injection
• CWE-116

Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)

• Bitdefender GravityZone Console On-Premise
• CWE-116

Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability

• Information disclosure
• CWE-116

<2.37.0 · fixed in 2.37.0

Denial of Service in Tink-cc

• Google Tink
• Google Tink (Legacy)
• CWE-116

TYPO3 vulnerable to an HTML Injection in the History Module

• Cross-site scripting (XSS)
• CWE-116

>=13.0.0, <13.1.1 · fixed in 13.1.1

Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

• cacti
• Cross-site scripting (XSS)
• CWE-116

Gradio before 4.20 allows credential leakage on Windows.

• CWE-116

<4.20.0 · fixed in 4.20.0

Command injection via array-ish $command parameter of proc_open()

• PHP
• CWE-116

Apache Zeppelin vulnerable to cross-site scripting in the helium module

• Cross-site scripting (XSS)
• CWE-116

>=0.8.2, <0.11.1 · fixed in 0.11.1

Improper escaping in Apache Zeppelin

• CWE-116

>=0.8.2, <0.11.1 · fixed in 0.11.1

KaTeX's `\includegraphics` does not escape filename

• CWE-116

>=0.11.0, <0.16.10 · fixed in 0.16.10

Information leakage in YAQL

• Information disclosure
• CWE-116

<3.0.0 · fixed in 3.0.0

SMTP Smuggling in Postal

• postal
• CWE-116

Multiple issues involving quote API

• CWE-116

>=0.0.0-0, <1.3.0 · fixed in 1.3.0

Improper input validation in Intel NUC BIOS firmware

• Intel NUC BIOS firmware
• CWE-20
• CWE-116

Improper output encoding in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• CWE-116

Uncontrolled resource consumption in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Denial of service
• CWE-116

Django Template Engine Vulnerable to XSS

• Cross-site scripting (XSS)
• CWE-20

<3.1.9 · fixed in 3.1.9

lockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization, which may allow bypass of intended access restrictions, such as when U+1FEF is converted to a backtick.

• CWE-116

HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end r…

• CWE-116

IBM QRadar WinCollect Agent improper output encoding

• IBM QRadar WinCollect Agent
• CWE-116

An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters.

• CWE-116

Mattermost password hash disclosure vulnerability

• Information disclosure
• CWE-116

<5.3.2-0.20230825233148-f787fd63368a · fixed in 5.3.2-0.20230825233148-f787fd63368a

HTML and SMTP Injection in LiquidFiles

• LiquidFiles
• CWE-116
• CWE-147

XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title

• CWE-116

>=7.2-milestone-2, <14.10.12 · fixed in 14.10.12

React Developer Tools extension Improper Authorization vulnerability

• Broken access control
• CWE-116

<4.28.4 · fixed in 4.28.4

Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device

• CWE-116

<9.6.16 · fixed in 9.6.16

Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0

• Wing FTP Server
• CWE-116

Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administrator into performing an unsafe action (v…

• CWE-116

Improper input validation in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• CWE-20
• CWE-116

Buffer overflow in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• Memory corruption
• CWE-116

Improper input validation in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• CWE-20
• CWE-116

Improper input validation in Huawei HarmonyOS and others

• Huawei HarmonyOS
• Huawei EMUI
• CWE-20
• CWE-116

OpenZeppelin Contracts vulnerable to Improper Escaping of Output

• CWE-116

>=4.0.0, <4.9.3 · fixed in 4.9.3

Critters Cross-site Scripting Vulnerability

• Cross-site scripting (XSS)
• CWE-116

>=0.0.17, <0.0.20 · fixed in 0.0.20

Improper input validation in Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME

• Intel(R) AMT and Intel(R) Standard Manageability in Intel (R) CSME
• CWE-20
• CWE-116

PrestaShop XSS injection through Validate::isCleanHTML method

• Cross-site scripting (XSS)
• CWE-116

<1.7.8.10 || >=8.0.0, <8.0.5 || >=8.1.0, <8.1.1 · fixed in 1.7.8.10, 8.0.5, 8.1.1

Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form validation could be bypassed.

• CWE-116

Envoy vulnerable to OAuth2 credentials exploit with permanent validity

• envoy
• CWE-116

Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax

• CWE-116
• CWE-644

<1.5.5 || >=2.0.0, <2.0.5 || >=2.1.0, <2.1.1 · fixed in 1.5.5, 2.0.5, 2.1.1

Froxlor vulnerable to Improper Encoding or Escaping of Output

• CWE-116

<2.0.21 · fixed in 2.0.21

Controller stack overflow when decoding messages from the server

• Honeywell C300
• CWE-116

Improper Encoding or Escaping of Output in GitLab

• GitLab
• CWE-116

TeamPass vulnerable to Improper Encoding or Escaping of Output

• CWE-116

<3.0.10 · fixed in 3.0.10