CWE-116.

Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

• CWE-116

<6.1.7.4 || >=7.0.0, <7.0.5.1 · fixed in 6.1.7.4, 7.0.5.1

Discourse's canonical url not being used for topic embeddings

• discourse
• CWE-116

Teampass Cross-site Scripting vulnerability

• CWE-116

<3.0.9 · fixed in 3.0.9

Improper output encoding in Mozilla Firefox for Android and others

• Mozilla Firefox for Android
• Mozilla Firefox
• CWE-116

Improper output encoding in Mozilla Firefox and others

• Mozilla Firefox
• Mozilla Focus for Android
• CWE-116

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").

• CWE-116

XWiki Platform vulnerable to RXSS via editor parameter - importinline template

• Cross-site scripting (XSS)
• CWE-116

>=2.2-milestone-1, <14.4.8 || >=14.5, <14.10.4 · fixed in 14.4.8, 14.10.4

Stored XSS affecting the AcyMailing plugin for Joomla

• AcyMailing Newsletter Plugin for Joomla in the Enterprise version
• CWE-20
• CWE-116

ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to change the title and then execute it as commands.

• CWE-116

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components.

• CWE-116

Flatpak metadata with ANSI control codes can cause misleading terminal output

• flatpak
• CWE-116

XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile

• CWE-116

>=6.2-milestone-1, <13.10.10 || >=14.0, <14.4.6 || >=14.5, <14.9 · fixed in 13.10.10, 14.4.6, 14.9

Keycloak Cross-site Scripting on OpenID connect login service

• Cross-site scripting (XSS)
• CWE-81

<20.0.5 · fixed in 20.0.5

Apache Tomcat improperly escapes input from JsonErrorReportValve

• Other injection
• CWE-116

>=8.5.83, <8.5.84 || >=9.0.40, <9.0.69 || >=10.1.0, <10.1.2 · fixed in 8.5.84, 9.0.69, 10.1.2

Improper output encoding in Mozilla Firefox

• Mozilla Firefox
• CWE-116

Improper output encoding in Mozilla Firefox ESR and others

• Mozilla Firefox ESR
• Mozilla Firefox
• CWE-116

Improper output encoding in KDDI CORPORATION, NTT DOCOMO, INC…

• KDDI CORPORATION, NTT DOCOMO, INC., and SoftBank Corp. KDDI +Message App for Android and for iOS, NTT DOCOMO +Message App for Android and for iOS, and SoftBank +Message App for Android and for iOS
• CWE-116

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks.

• CWE-116

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui

• Other injection
• CWE-116

<13.10.8 || >=14.0.0, <14.4.3 · fixed in 13.10.8, 14.4.3

Heron allows CRLF log injection

• CWE-116

<0.20.5-incubating · fixed in 0.20.5-incubating

Moodle Improper Encoding or Escaping of Output

• CWE-116

>=3.9, <3.9.10 || >=3.10, <3.10.7 || >=3.11, <3.11.3 · fixed in 3.9.10, 3.10.7, 3.11.3

In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution.

• CWE-116

XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability

• Code injection
• CWE-116

>=5.3-milestone-2, <13.10.6 || >=14.0, <14.4 · fixed in 13.10.6, 14.4

XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

• Code injection
• CWE-116

>=1.7 · no fixed version yet

ansible-runner vulnerable to shell command injection

• CWE-20
• CWE-116

<2.1.0 · fixed in 2.1.0

OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

• CWE-116

<1.9.2 || >=2.0.0.pre.rc1, <2.0.0 · fixed in 1.9.2, 2.0.0

WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection

• Code injection
• CWE-116

<6.6.0 · fixed in 6.6.0

Log Injection in Apache Sling Commons Log and Apache Sling API

• Other injection
• CWE-116

<=2.25.0 · no fixed version yet

motoradmin - host header Injection in the reset password functionality

• motor-admin
• CWE-116

Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

• Cross-site scripting (XSS)
• CWE-116

>=5.4.4, <12.10.11 || >=13.0.0, <13.4.7 || >=13.5.0, <13.10.3 · fixed in 12.10.11, 13.4.7, 13.10.3

Cross-site Scripting in wiki manager join wiki page

• Cross-site scripting (XSS)
• CWE-116

<12.10.11 || >=13.0.0, <13.4.7 || >=13.5.0, <13.10.3 · fixed in 12.10.11, 13.4.7, 13.10.3

Cross-site Scripting in the Flamingo theme manager

• Cross-site scripting (XSS)
• CWE-116

<12.10.11 || >=13.0.0, <13.4.7 || >=13.5.0, <13.10.3 · fixed in 12.10.11, 13.4.7, 13.10.3

Improper Encoding or Escaping of Output in Apache Superset

• Other injection
• CWE-116

<1.3.2 · fixed in 1.3.2

Stored XSS vulnerability in Jenkins Git Plugin

• Cross-site scripting (XSS)
• CWE-116

<4.8.3 · fixed in 4.8.3

MediaWiki makeCollapsible allows applying event handler to any CSS selector

• Other injection
• CWE-116

>=1.31.0, <1.31.7 || >=1.33.0, <1.33.3 || >=1.34.0, <1.34.1 · fixed in 1.31.7, 1.33.3, 1.34.1

Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin

• CWE-116

<1.25 · fixed in 1.25

Command injection in Apache Maven maven-shared-utils

• Command injection
• CWE-116

<3.3.3 · fixed in 3.3.3

Cross-site Scripting in Jenkins Random String Parameter Plugin

• Cross-site scripting (XSS)
• CWE-116

<=1.0 · no fixed version yet

Log value insertion in craftercms

• Other injection
• CWE-116

>=3.1.0, <3.1.18 · fixed in 3.1.18

Nicotine+ DoS on Null Character in Download Request

• CWE-116

>=3.0.3, <3.2.1 · fixed in 3.2.1

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

• CWE-116

Improper escaping in XWiki Platform

• CWE-116

<12.8 · fixed in 12.8

Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible

• Other injection
• Information disclosure

<2.10.0 · fixed in 2.10.0

Path traversal in xwiki-platform-skin-skinx

• Path traversal
• CWE-116

>=6.2-rc-1, <13.6 · fixed in 13.6

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021.

• CWE-116

Code injection in iTunesRPC-Remastered

• CWE-116

Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker

• Other injection
• CWE-116

<1.16.3 · fixed in 1.16.3

API giving out files without key

• Redon-Tech Roblox-Purchasing-Hub
• CWE-116

Inconsistent input sanitisation leads to XSS vectors

• Cross-site scripting (XSS)
• CWE-116

<4.4.1 · fixed in 4.4.1

Improper Encoding or Escaping of Output in Asset Metadata Component

• Cross-site scripting (XSS)
• CWE-116

<10.1.2 · fixed in 10.1.2

Authentication Bypass by Alternate Name in Apache Tomcat

• Authentication bypass
• CWE-116

>=10.0.0-M1, <10.0.5 || >=9.0.0M1, <9.0.45 || >=8.5.0, <8.5.65 · fixed in 10.0.5, 9.0.45, 8.5.65

Misinterpretation of malicious XML input

• CWE-116

<=0.6.0 · no fixed version yet

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.js

• TekMonksGitHub monkshu
• Cross-site scripting (XSS)
• CWE-116

Reflected XSS in GTranslate Pro and GTranslate Enterprise < 2.8.65

• Translate AI Multilingual Solutions GTranslate Pro and GTranslate Enterprise
• CWE-116

Filenames not escaped by default in controllers using DownloadResponse

• nextcloud security-advisories
• CWE-116

Control character injection in console output in github.com/ipfs/go-ipfs

• CWE-116
• CWE-150

<0.8.0 · fixed in 0.8.0

Improper output encoding in Gallagher Command Centre

• Gallagher Command Centre
• CWE-116

keycloak Self Stored Cross-site Scripting vulnerability

• Cross-site scripting (XSS)
• CWE-20

<13.0.0 · fixed in 13.0.0

CSV Formula Injection possible due to improper fields escaping in GateManager

• Secomea GateManager
• CWE-116

Secret disclosure when containing characters that become URI encoded

• CWE-116

<17.2.3 · fixed in 17.2.3