CWE-116 Improper Encoding or Escaping of Output
classThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (696)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-20245US | —OT critical | KEV | ||
A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator,… | ||||
| CVE-2024-38475US | critical9.1OT critical | KEV | ||
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the se… | ||||
| CVE-2022-42948US | critical9.8OT critical | KEV | ||
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the C… | ||||
| CVE-2022-24682US | medium6.1OT critical | KEV | ||
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attack… | ||||
| CVE-2009-1151US | critical9.8OT critical | KEV | ||
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configurati… | ||||
| CVE-2022-36446US | critical9.8 | Exploit | ||
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. | ||||
| CVE-2022-30781US | high7.5 | Exploit | ||
Gitea before 1.16.7 does not escape git fetch remote. | ||||
| CVE-2021-31806US | medium6.5 | Exploit | ||
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the pro… | ||||
| CVE-2013-4547US | high7.5 | Exploit | ||
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI. | ||||
| CVE-2022-36099US | high8.8 | — | ||
XWiki Platform Wiki UI Main Wiki is software for managing subwikis on XWiki Platform, a generic wiki platform. Starting with version 5.3-milestone-2 and prior to versions 13.10.6 a… | ||||
| CVE-2023-32071US | critical9.0 | — | ||
XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the r… | ||||
| CVE-2022-36100US | high8.8 | — | ||
XWiki Platform Applications Tag and XWiki Platform Tag UI are tag applications for XWiki, a generic wiki platform. Starting with version 1.7 in XWiki Platform Applications Tag and… | ||||
| CVE-2004-0595US | medium6.8 | Exploit | ||
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows d… | ||||
| CVE-2022-25235US | critical9.8 | Exploit | ||
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | ||||
| CVE-2021-28662US | medium6.5 | — | ||
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This hea… | ||||
| CVE-2025-31651US | critical9.8 | Exploit | ||
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible
for a specially… | ||||
| CVE-2020-24972US | high8.8 | Exploit | ||
The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handlin… | ||||
| CVE-2017-8303US | critical9.8 | — | ||
An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter. | ||||
| CVE-2009-4487US | medium6.8 | Exploit | ||
nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary com… | ||||
| CVE-2000-0081US | high10.0 | — | ||
Hotmail does not properly filter JavaScript code from a user's mailbox, which allows a remote attacker to execute the code by using hexadecimal codes to specify the javascript: pro… | ||||
04
attack patterns (4)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan