CWE-116.

Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

• Code injection
• CWE-116

<39.8.7 || >=40.0.0-alpha.1, <40.9.0 || >=41.0.0-alpha.1, <41.2.0 || >=42.0.0-alpha.1, <42.0.0-beta.1 · fixed in 39.8.7, 40.9.0, 41.2.0, 42.0.0-beta.1

CentreStack < 17.4 Session Injection via SelectProvider.aspx

• Gladinet CentreStack
• CWE-116

mathlive's Lack of Escaping of HTML allows for XSS

• CWE-116

<0.110.0 · fixed in 0.110.0

Terminal Escape Injection in diff‑so‑fancy

• diff-so-fancy
• CWE-116

Shescape: Home-directory disclosure in assignment context on Unix with Dash

• Information disclosure
• CWE-116

<2.1.14 || >=3.0.0, <3.0.1 · fixed in 2.1.14, 3.0.1

ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797

• Cross-site scripting (XSS)
• CWE-116

<14.10.3 · fixed in 14.10.3

Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802

• Loytec LWEB-802
• Cross-site scripting (XSS)
• CWE-116

Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server

• Loytec LIP-ME20xC
• Loytec L-INX
• Cross-site scripting (XSS)
• CWE-116

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

• Cross-site scripting (XSS)
• CWE-116

>=3.3.0, <4.5.10 || >=4.6.0, <4.6.2 · fixed in 4.5.10, 4.6.2

Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences

• CWE-116

>=13.0.0, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

• Cross-site scripting (XSS)
• CWE-116

>=4.0.0, <4.12.27 · fixed in 4.12.27

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

• Cross-site scripting (XSS)
• CWE-116

>=3.10.0, <7.0.4 · fixed in 7.0.4

Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerability

• CWE-116

>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10 · fixed in 8.0.29, 9.0.18, 10.0.10

An issue was discovered in openRISC OR1200 commit 83ac6b.

• CWE-116

Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema

• CWE-116

<6.3.4 · fixed in 6.3.4

Github.com/cri-o/cri-o: fix bypass for cve-2022-4318 — /etc/passwd injection via home env

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.13
• Memory corruption
• CWE-116

Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116)

• Adobe Commerce
• Adobe Commerce B2B
• CWE-116

FacturaScripts: Stored XSS in WidgetVariante and WidgetSubcuenta modal lists via HTML-attribute decoding of `Tools::noHtml`-escaped quotes inside `onclick=`

• Cross-site scripting (XSS)
• CWE-116

<2026.2 · fixed in 2026.2

HedgeDoc: Stored HTML injection via email local-part

• hedgedoc
• Cross-site scripting (XSS)
• CWE-116

luci-app-banip Log Monitor IP Extraction Bypass

• openwrt luci-app-banip
• CWE-116

Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization

• CWE-116

>=2.13.1, <2.25.5 || >=2.26.0, <2.26.1 · fixed in 2.25.5, 2.26.1

Grist: XSS through unsafe value interpolation in server-rendered pages

• gristlabs grist-core
• Cross-site scripting (XSS)
• CWE-116

SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)

• siyuan
• Cross-site scripting (XSS)
• Code injection

YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

• Cross-site scripting (XSS)
• CWE-116

<4.6.6 · fixed in 4.6.6

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

• CWE-116

<0.3.0-rc.1 · fixed in 0.3.0-rc.1

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

• CWE-116
• CWE-754

<0.6.0 · fixed in 0.6.0

comm: lossy UTF-8 conversion silently corrupts non-UTF-8 output

• CWE-116
• CWE-176

<0.6.0 · fixed in 0.6.0

Improper Output Neutralization for Logs in Kibana Leading to Log Injection

• Elastic Kibana
• CWE-116

Dragonfly: RESP Protocol Injection via Lua redis.error_reply() in EvalSerializer

• dragonfly
• CWE-116

Improper output encoding in Apple swift-nio-http2

• Apple swift-nio-http2
• CWE-116

justhtml: to_markdown() code-span blank-line breakout enables XSS

• Cross-site scripting (XSS)
• CWE-116

>=0.9.0, <1.22.0 · fixed in 1.22.0

Prometheus denial of service via crafted DNS queries

• PowerDNS DNSdist
• CWE-116

SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped `data-obj` attribute (Bypass for CVE-2026-45375's patch)

• siyuan
• Cross-site scripting (XSS)
• Code injection

Warp: OS command injection when opening terminal links from WSL

• warp
• Command injection
• CWE-116

Duplicate Advisory: ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

• Command injection
• CWE-116

<14.10.3 · fixed in 14.10.3

Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

• CWE-116

>=1.2.0, <2.10.0 · fixed in 2.10.0

OpenZeppelin Contracts Wizard: Line terminators in info.securityContact / info.license can inject lines into generated source

• Code injection
• CWE-116

<0.10.11 · fixed in 0.10.11

pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser

• pgadmin.org pgAdmin 4
• Cross-site scripting (XSS)
• CWE-116

pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text

• pgadmin.org pgAdmin 4
• Cross-site scripting (XSS)
• CWE-116

pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates

• pgadmin.org pgAdmin 4
• SQL injection
• CWE-116

Heimdall: IP Spoofing via Unvalidated Forwarding Headers

• Authentication bypass
• CWE-20

<0.17.17 · fixed in 0.17.17

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

• Cross-site scripting (XSS)
• CWE-116

<0.9.6 · fixed in 0.9.6

Laravel Framework: Temporary Signed URL Path Confusion

• CWE-116

<12.61.1 || >=13.0.0, <13.12.0 · fixed in 12.61.1, 13.12.0

Caddy: stripHTML template function bypass

• CWE-116

<=1.0.5 · no fixed version yet

hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

• CWE-116

<4.12.25 · fixed in 4.12.25

Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

• Cross-site scripting (XSS)
• CWE-116

<7.4.0 · fixed in 7.4.0

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

• Cross-site scripting (XSS)
• CWE-116

<6.6.3 · fixed in 6.6.3

Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.

• duck-organization questbot
• CWE-116

Quest Bot: Unban and unwarn reason fields still allow bot-powered mass mentions.

• duck-organization quest-bot
• CWE-116

Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings

• duck-organization quest-bot
• CWE-116

Quest Bot: Ticket reason allows mass-mention injection

• duck-organization quest-bot
• CWE-116

Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

• duck-organization quest-bot
• CWE-116

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

• Information disclosure
• CWE-116

<0.3.2 · fixed in 0.3.2

Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet

• xibosignage xibo-cms
• Cross-site scripting (XSS)
• CWE-116

MISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labels

• misp bsimvis
• Cross-site scripting (XSS)
• CWE-116

FreeSWITCH includes a vulnerable function, PREFIX(prologTok)() from libexpat

• signalwire freeswitch
• CWE-116

Injection in Rapid7 Velociraptor

• Rapid7 Velociraptor
• Other injection
• Code injection

Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability

• Cisco Catalyst SD-WAN Controller
• Cisco Catalyst SD-WAN Manager
• CWE-116

GLPI has stored XSS in asset locks

• glpi
• Cross-site scripting (XSS)
• CWE-116

CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

• CWE-116

>=0.8.0, <1.18.3 · fixed in 1.18.3