CWE-116.

HTML Injection in Logo Software's Logo Cloud

• Logo Software Inc. Logo Cloud
• CWE-116

get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass

• CWE-116

<11.0.2 · fixed in 11.0.2

Potential XSS in Extension:BlueSpiceWhoIsOnline

• Hallo Welt! GmbH BlueSpice
• CWE-116

Potential XSS in Extension:BlueSpiceAvatars

• Hallo Welt! GmbH BlueSpice
• CWE-116

Potential XSS in Extension:AtMentions

• Hallo Welt! GmbH BlueSpice
• CWE-116

HTML Injection in Patika Global Technologies' HumanSuite

• Patika Global Technologies HumanSuite
• Other injection
• Cross-site scripting (XSS)

XWiki Remote Macros vulnerable to remote code execution using the confluence paste code macro

• xwikisas xwiki-pro-macros
• CWE-116

XWiki Remote Macros vulnerable to remote code execution using the ConfluenceLayoutSection macro

• xwikisas xwiki-pro-macros
• CWE-116

Element Plus Link component (el-link) implements insufficient input validation for the href attribute

• Cross-site scripting (XSS)
• Open redirect

<=2.11.0 · no fixed version yet

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.

• Other injection
• HTTP request smuggling

Improper output encoding in Google Android

• Google Android
• CWE-116

Duplicate Advisory: Multiple issues involving quote API in shlex

• CWE-116

<1.3.0 · fixed in 1.3.0

ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`

• ETQ Reliance CG (legacy)
• Cross-site scripting (XSS)
• CWE-116

Incorrect parsing of URLs could have allowed embedding of youtube.com

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-116

WilderForge vulnerable to code Injection via GitHub Actions Workflows

• WilderForge
• Code injection
• CWE-116

Discourse vulnerable to HTML injection when inviting to topic via email

• discourse
• Cross-site scripting (XSS)
• CWE-116

IBM Security Guardium information disclosure

• IBM Security Guardium
• CWE-116

Devtools' preview ignored CSP headers

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-116

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack.

• Yandex Browser
• CWE-116

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar.

• Yandex Browser Lite
• CWE-116

PX Backup Improper Sanitization Vulnerability

• Pure Storage PX Backup
• CWE-116

Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow

• CWE-116

>=7.0.0, <13.4.2 || >=14.0.0, <15.1.2 · fixed in 13.4.2, 15.1.2

Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by adding a special character to the request.

• CWE-116

Misskey CSS Style Injection Vulnerability In `MkUrlPreview`

• misskey
• CWE-20
• CWE-116

Improper output encoding in Bosch Rexroth AG ctrlX OS - Solutions

• Bosch Rexroth AG ctrlX OS - Solutions
• CWE-116

YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution

• CWE-116

<4.5.4 · fixed in 4.5.4

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

• Privilege escalation
• CWE-116

>=15.9-rc-1, <15.10.8 || >=16.0.0-rc-1, <16.2.0 · fixed in 15.10.8, 16.2.0

Potential local code execution in "copy as cURL" command

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-116

Apache Tomcat Rewrite rule bypass

• CWE-116
• CWE-150

>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100 · fixed in 9.0.104, 10.1.40, 11.0.6

Improper output encoding in Dell PowerProtect Data Manager

• Dell PowerProtect Data Manager
• CWE-116

XSSes and potential RCE in Special:VersionCompare

• The Wikimedia Foundation Mediawiki - Version Compare Extension
• CWE-116

HTML injection in feed output from i18n message

• The Wikimedia Foundation Mediawiki Core - Feed Utils
• CWE-116

XSSes in Extension:ConfirmAccount

• The Wikimedia Foundation Mediawiki - Confirm Account Extension
• CWE-116

Junos OS: Processing of a specific BGP update causes the SRRD process to crash

• Juniper Networks Junos OS
• CWE-116

Django TomSelect incomplete escaping of dangerous characters in widget attributes

• Cross-site scripting (XSS)
• CWE-116

<2025.3.3 · fixed in 2025.3.3

Improper output encoding in Intevation OpenSlides

• Intevation OpenSlides
• CWE-116

Improper output encoding in Synology DiskStation Manager (DSM) and others

• Synology DiskStation Manager (DSM)
• Synology BeeStation OS (BSM)
• CWE-116

Improper output encoding in Synology DiskStation Manager (DSM) and others

• Synology DiskStation Manager (DSM)
• Synology BeeStation OS (BSM)
• CWE-116

Mishandling of comma during folding and unicode-encoding of email headers

• Python Software Foundation CPython
• CWE-116

DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace

• Cross-site scripting (XSS)
• CWE-116

<0.39.5 · fixed in 0.39.5

Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)

• Cross-site scripting (XSS)
• CWE-116

<1.9.4 · fixed in 1.9.4

Coolify Vulnerable to Reflected XSS on Tag Search

• coollabsio coolify
• CWE-116

MathLive's Lack of Escaping of HTML allows for XSS

• Cross-site scripting (XSS)
• CWE-116

<0.104.0 · fixed in 0.104.0

WordPress Poll Maker Plugin < 5.5.5 - HTML Injection vulnerability

• Ays Pro Poll Maker
• CWE-116

KaTeX \htmlData does not validate attribute names

• Cross-site scripting (XSS)
• CWE-116

>=0.12.0, <0.16.21 · fixed in 0.16.21

The sideband payload is passed unfiltered to the terminal in git

• git
• CWE-116
• CWE-150

Git does not sanitize URLs when asking for credentials interactively

• git
• CWE-116
• CWE-147

Newline confusion in credential helpers can lead to credential exfiltration in git

• git
• CWE-116
• CWE-147

Koji Cross-site Scripting

• CWE-116

<1.33.2 || >=1.34.0, <1.34.3 || >=1.35.0, <1.35.1 · fixed in 1.33.2, 1.34.3, 1.35.1

XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

• CWE-116

>=6.3-milestone-2, <13.10.5 || >=14.0-rc-1, <14.3-rc-1 · fixed in 13.10.5, 14.3-rc-1

Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

• Apache Software Foundation Apache Subversion
• CWE-20
• CWE-116

A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control valida…

• CWE-116

Improper output encoding in Google Android

• Google Android
• CWE-116

Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability

• CWE-116
• CWE-644

>=1.9.0, <1.20.1 · fixed in 1.20.1

A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a CRLF injection attack d…

• CWE-116

A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the file…

• Cross-site scripting (XSS)
• CWE-116

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view

• Docker Desktop
• CWE-20
• CWE-116

Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure

• Apache Software Foundation Apache CloudStack
• CWE-20
• CWE-116

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can hav…

• CWE-116

CSS sanitizer used incorrectly, and is easily bypassed

• The Wikimedia Foundation Mediawiki - CSS Extension
• CWE-116