CWE-116.

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

• CWE-116

<1.7.20 · fixed in 1.7.20

MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread

• MISP
• Cross-site scripting (XSS)
• CWE-20

Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

• warp-tech warpgate
• Authentication bypass
• CWE-116

draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642

• jgraph drawio
• Cross-site scripting (XSS)
• CWE-116

Improper output encoding in Synology DiskStation Manager (DSM)

• Synology DiskStation Manager (DSM)
• CWE-116

Improper output encoding in Synology DiskStation Manager (DSM)

• Synology DiskStation Manager (DSM)
• CWE-116

Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

• givanz Vvveb
• Cross-site scripting (XSS)
• CWE-116

djust: A template binding inherits a context safety grant it never earned (XSS)

• Cross-site scripting (XSS)
• CWE-116

<1.1.2 · fixed in 1.1.2

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

• Cross-site scripting (XSS)
• CWE-116

<1.1.1 · fixed in 1.1.1

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

• CWE-116

<1.13.0 · fixed in 1.13.0

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

• Functional Software, Inc. Sentry Seer
• Other injection
• Code injection

Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails

• Royal Addons for Elementor
• CWE-116

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhau…

• Arista Networks EOS
• CWE-116

Apache Syncope: CSV export spreadsheet formula injection

• Apache Software Foundation Apache Syncope
• CWE-116

Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements

• Cross-site scripting (XSS)
• CWE-116

<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4 · fixed in 20.3.30, 21.2.22, 22.1.4

MISP: Unescaped HTML Injection in PDF Report Element Rendering

• MISP
• Cross-site scripting (XSS)
• CWE-116

NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

• NationalSecurityAgency skills-service
• Cross-site scripting (XSS)
• CWE-20

Improper output encoding in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• CWE-116

Improper output encoding in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• CWE-116

Improper output encoding in Google Chrome

• Google Chrome
• CWE-116

SWC HTML minifier may allow script element breakout when minifying embedded JSON

• Cross-site scripting (XSS)
• CWE-116

<59.0.0 · fixed in 59.0.0

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-116

ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

• CWE-116

>=0.1.3, <0.3.1 · fixed in 0.3.1

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Orval: Import-time RCE via schema default -> zod module-level template literal

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Orval: Import-time RCE via array-items default -> zod module-level template literal

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

• Code injection
• CWE-116

<8.21.0 · fixed in 8.21.0

Improper output encoding in Jenkins

• Jenkins
• CWE-116

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

• CWE-116

<=0.6.0 · no fixed version yet

Template injection in Eclipse Foundation Eclipse Ditto

• Eclipse Foundation Eclipse Ditto
• Other injection
• Code injection

Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export

• ellite Wallos
• Other injection
• CWE-116

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

• CWE-116

>=0.3.0-rc.0, <1.3.1 · fixed in 1.3.1

MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

• SQL injection
• CWE-116

<3.2.4 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3 · fixed in 3.2.4, 3.3.4, 3.4.6, 3.5.3

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

• CWE-116
• CWE-838

<1.4.1 · fixed in 1.4.1

PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI

• CWE-116

<2.0.5 · fixed in 2.0.5

gitoxide before 0.38.2 Credential Helper Protocol Field Injection

• gitoxide
• CWE-116

Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver

• MongoDB C++ Driver
• CWE-116

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal c...

• CWE-116

<1.4.9 · fixed in 1.4.9

Improper output encoding in NVIDIA OpenShell

• NVIDIA OpenShell
• CWE-116

eml_parser has a URL extraction bypass via HTML entities in URLs

• CWE-116

<3.0.2 · fixed in 3.0.2

Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

• Cross-site scripting (XSS)
• CWE-116

<0.19.1 · fixed in 0.19.1

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

• CWE-116

<8.0.3 · fixed in 8.0.3

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI

• Apache Software Foundation Apache CloudStack
• CWE-116

Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI

• Apache Software Foundation Apache CloudStack
• CWE-116

Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)

• Command injection
• CWE-20

>=4.1.0, <4.1.72 || >=5.0.0, <5.6.2 || >=6.0.0, <6.8.13 || >=7.0.0, <7.0.36 · fixed in 4.1.72, 5.6.2, 6.8.13, 7.0.36

DS8900F and DS8A00 Authentication Bypass

• IBM DS8A00 (R10.0 - R10.1)
• IBM DS8900F (R9.4)
• CWE-116

jmespath.php has CompilerRuntime code injection via unescaped function names

• Code injection
• CWE-20

<2.9.1 · fixed in 2.9.1

Forem: Stored XSS in Admin Abuse Report Rendering

• forem
• Other injection
• Cross-site scripting (XSS)

Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

• CWE-116

>=2.9.0, <2.20.0 · fixed in 2.20.0

Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox

• ericcornelissen shescape
• Information disclosure
• CWE-116

dua-cli Terminal Escape Sequence Injection via Marked Paths

• Byron dua-cli
• CWE-116

gdu Terminal Injection via Unstripped Escape Sequences

• dundee gdu
• CWE-116

HCL AION is affected by multiple security vulnerabilities.

• HCL Software AION
• CWE-116

ColdFusion | Improper Encoding or Escaping of Output (CWE-116)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• CWE-116

cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting

• MISP cti-transmute
• Cross-site scripting (XSS)
• CWE-116

cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata

• MISP cti-transmute
• Cross-site scripting (XSS)
• CWE-116

Improper Output Encoding in GNU cpio

• GNU cpio
• CWE-116