CWE-116.

h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read

• Path traversal
• CWE-116

<1.15.6 || >=2.0.0, <2.0.1-rc.15 · fixed in 1.15.6, 2.0.1-rc.15

Heimdall: Path received via Envoy gRPC corrupted when containing query string

• Broken access control
• CWE-116

>=0.7.0-alpha, <0.17.11 · fixed in 0.17.11

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

• vapor leaf-kit
• Cross-site scripting (XSS)
• CWE-116

jsPDF has a PDF Object Injection via FreeText color

• Code injection
• CWE-116

<4.2.1 · fixed in 4.2.1

Incomplete control character validation in http.cookies

• Python Software Foundation CPython
• CWE-20
• CWE-116

Improper Encoding or Escaping of Output in GitLab

• GitLab
• CWE-116

CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization

• Cross-site scripting (XSS)
• CWE-116

>=4.15.3, <4.17.3 || >=5.7.5, <5.9.7 · fixed in 4.17.3, 5.9.7

OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects

• Hard-coded credentials
• CWE-116

<2026.3.7 · fixed in 2026.3.7

XWiki Blog Application home page vulnerable to Stored XSS via Post Title

• Cross-site scripting (XSS)
• CWE-116

>=9.15, <9.15.7 · fixed in 9.15.7

OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling

• Command injection
• CWE-116

<2026.2.19 · fixed in 2026.2.19

lxml-html-clean has <base> tag injection through default Cleaner configuration

• CWE-116

<0.4.4 · fixed in 0.4.4

lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes

• CWE-116

<0.4.4 · fixed in 0.4.4

Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover

• Wei-Shaw sub2api
• CWE-116

Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module

• Cross-site scripting (XSS)
• CWE-116

<=0.24.6 · no fixed version yet

ImageMagick: SVG-to-MVG Command Injection via coders/svg.c

• Command injection
• CWE-116

<14.10.3 · fixed in 14.10.3

OpenEMR allows inconsistent escaping of translation function output

• openemr
• CWE-116

Isso affected by Stored XSS via comment website field

• Cross-site scripting (XSS)
• CWE-116

<0.13.2 · fixed in 0.13.2

Tenda F3 Reflected Script Execution via Missing nosniff Header

• Shenzhen Tenda Technology Co., Ltd. Tenda F3
• Cross-site scripting (XSS)
• CWE-116

OpenSift: Persistent XSS Chat Tool Rendering

• OpenSift
• Cross-site scripting (XSS)
• CWE-116

Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table

• pi-hole web
• Cross-site scripting (XSS)
• CWE-20

Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute

• pi-hole web
• Cross-site scripting (XSS)
• CWE-20

jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

• CWE-116

<4.2.0 · fixed in 4.2.0

jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

• Code injection
• CWE-116

<4.2.0 · fixed in 4.2.0

Fabric.js Affected by Stored XSS via SVG Export

• Cross-site scripting (XSS)
• CWE-116

<7.2.0 · fixed in 7.2.0

LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()

• Cross-site scripting (XSS)
• CWE-116

>=24.10.0, <26.2.0 · fixed in 26.2.0

FileRise affected by HTML Injection using color property in file tags

• error311 FileRise
• Cross-site scripting (XSS)
• CWE-116

Tanium addressed an improper output sanitization vulnerability in TanOS.

• Tanium Appliance
• CWE-116

HtmlSanitizer has a bypass via template tag

• Cross-site scripting (XSS)
• CWE-116

<9.0.892 || >=9.1.878-beta, <9.1.893-beta · fixed in 9.0.892, 9.1.893-beta

jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution

• Code injection
• CWE-116

<4.1.0 · fixed in 4.1.0

Discourse allows script execution in uploaded HTML/XML files on S3

• discourse
• CWE-116

CSS-based exfiltration of the content from partially encrypted emails when allowing remote content

• Mozilla Thunderbird
• Information disclosure
• Cross-site request forgery (CSRF)

Tenda W30E V2 Lacks X-Content-Type-Options Header

• Shenzhen Tenda Technology Co., Ltd. W30E V2
• CWE-116

Typemill has Reflected XSS via login error view template

• typemill
• Cross-site scripting (XSS)
• CWE-116

Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering

• docmost
• Cross-site scripting (XSS)
• CWE-116

5ire vulnerable to Remote Code Execution (RCE)

• nanbingxyz 5ire
• CWE-116

OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over

• HackUCF OnboardLite
• Cross-site scripting (XSS)
• CWE-20

Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint

• Altium Live
• Cross-site scripting (XSS)
• CWE-116

ApprovedRevs allows bypassing the inline CSS sanitizer

• The Wikimedia Foundation Mediawiki - ApprovedRevs Extension
• CWE-116

Coolify has Stored XSS in Project Name

• coollabsio coolify
• CWE-116

Improper output encoding in Roundcube Webmail

• Roundcube Webmail
• CWE-116

Improper Encoding or Escaping of Output in GitLab

• GitLab
• CWE-116

Improper Encoding or Escaping of Output in GitLab

• GitLab
• CWE-116

Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform

• SAP_SE SAP BusinessObjects Business Intelligence Platform
• CWE-116

Nextcloud Deck app allows to spoof file extensions by using RTLO characters

• nextcloud security-advisories
• CWE-116

Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

• Cross-site scripting (XSS)
• CWE-116

<0.6.37 · fixed in 0.6.37

PX Enterprise Improper Sanitization Vulnerability

• Pure Storage PX Enterprise
• CWE-116

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final...

• CWE-116

>=1.0.0, <2025.7.2 · fixed in 2025.7.2

Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard

• EmbySupport Emby.Security
• Cross-site scripting (XSS)
• CWE-116

SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability

• SolarWinds Serv-U
• CWE-116

FactoryTalk® DataMosaix™ Private Cloud – Persistent XSS

• Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud
• CWE-116

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.

• Cross-site scripting (XSS)
• CWE-20

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA.

• CWE-20
• CWE-116

motionEye vulnerable to RCE via unsanitized motion config parameter

• Command injection
• CWE-20

<0.43.1b5 · fixed in 0.43.1b5

Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command

• Nagios XI
• Cross-site scripting (XSS)
• CWE-116

DOS Vulnerability in ZTE MC889A Pro product

• ZTE MC889A Pro
• CWE-116

Potential user-assisted code execution in “Copy as cURL” command

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-116

An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

• Mozilla Firefox
• Mozilla Thunderbird
• CWE-116

python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination

• CWE-116
• CWE-170

<3.4.5 · fixed in 3.4.5

A HTML injection vulnerability exists in Perfex CRM v3.3.1.

• CWE-116

pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters

• Other injection
• Cross-site scripting (XSS)

<0.5.0b3.dev91 · fixed in 0.5.0b3.dev91