Weaknesses of type CWE-86

11 results

Neutralização inadequada de caracteres inválidos em identificadores web

A aplicação não valida ou sanitiza corretamente caracteres especiais em identificadores (IDs, nomes de usuário, slugs de URL) antes de usá-los em HTML, JavaScript ou SQL. Um atacante injeta caracteres malformados que contornam filtros e permitem execução de código ou manipulação do DOM.

Example

Um sistema de comentários aceita um campo 'author' sem validação. Se alguém envia author='<img src=x onerror=alert(1)>' e o código renderiza isso diretamente em HTML como <span id=author>...</span>, o JavaScript malicioso executa no navegador de quem lê o comentário.

How to mitigate

Valide e normalize identificadores contra uma whitelist de caracteres seguros (alfanuméricos, hífen, underscore). Escape ou encode sempre que renderizar em contexto HTML, JavaScript ou SQL — use libs de template seguras (Twig, Jinja) ou funções nativas de escape (htmlspecialchars em PHP, textContent em JS).

CVE-2026-28417MEDIUMVim has OS Command Injection in netrwEPSS 1.2%CVE-2023-31126CRITICALImproper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xmlEPSS 0.8%CVE-2023-22840LOWImproper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentiallEPSS 0.4%CVE-2024-10941MEDIUMA malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affEPSS 0.4%CVE-2025-20166MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-21864HIGHImproper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated usEPSS 0.3%CVE-2025-20168MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-20167MEDIUMCisco Common Services Platform Collector Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2025-66606LOWA vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An atEPSS 0.2%CVE-2021-33158HIGHImproper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privilegEPSS 0.2%CVE-2026-71478MEDIUMleague/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytesEPSS 0.2%