On this page

CWE-116: Improper Encoding or Escaping of Output

Weakness Summary

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

  • Canonical source: MITRE CWE-116
  • Published Atomicorp CVE observations: 24
  • Distinct affected products in those observations: 24
  • Active Atomicorp rules associated with this weakness: 44

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2026-106102Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()quasarProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2022-36446Webmin Package Updates RCEwebminProtected by Atomicorp rules341245 , 344364 , 392301 , 393655
CVE-2026-18516Improper Encoding or Escaping of Output in Crafty ControllerCrafty ControllerProtected by Atomicorp rules340099 , 341099
CVE-2026-54694NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeoverskills-serviceProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-55570SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped data-obj attribute (Bypass for CVE-2026siyuanProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755
CVE-2026-12496Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA serverLIP-ME20xCProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-35569ApostropheCMS: Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMSapostrophecmsProtected by Atomicorp rules340099 , 341099
CVE-2024-38473Apache HTTP Server - ACL BypassApache HTTP ServerProtected by Atomicorp rules390709
CVE-2026-55659Grist: XSS through unsafe value interpolation in server-rendered pagesgrist-coreProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-35534ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionchurchcrmProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-54506Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio fieldVvvebProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 340247 , 340248 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2025-60787Remote Code Execution Vulnerability in MotionEye Frontend (CVE-2025-60787)motioneyeProtected by Atomicorp rules330791 , 340152 , 393655
CVE-2026-40871mailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via APImailcow-dockerizedProtected by Atomicorp rules340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572
CVE-2021-34630GTranslate < 2.8.65 - Cross-Site ScriptinggtranslateProtected by Atomicorp rules340147 , 340148 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-107393FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP HeaderfreescoutProtected by Atomicorp rules333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755
CVE-2026-26028CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSScryptpadProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-33436Stirling-PDF: Reflected XSS through crafted filename in file upload functionalitystirling pdfProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148
CVE-2026-40483ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment FieldCRMProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-41318AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTManythingllmProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148
CVE-2026-35208lichess.org has an Unsanitized Stream Title Injection on /streamerlilaProtected by Atomicorp rules333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755
CVE-2025-34141ETQ Reliance - Reflected XSS via SQLConverterServletrelianceProtected by Atomicorp rules333141 , 340099 , 340147 , 341099 , 342259 , 347198
CVE-2026-34246CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML OutputpanelProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755
CVE-2026-112949Vitest: Code injection via unauthenticated manual mock registrationvitestProtected by Atomicorp rules340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655
CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsastroProtected by Atomicorp rules333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148

Associated Atomicorp WAF Rules

RuleStatusBehavior
330791Activedisruptive (deny)
333140Activedisruptive (deny)
333141Activedisruptive (deny)
340014Activedisruptive (deny)
340016Activedisruptive (deny)
340017Activedisruptive (deny)
340023Activedisruptive (deny)
340029Activedisruptive (deny)
340087Activedisruptive (deny)
340095Activedisruptive (deny)
340099Activedisruptive (deny)
340144Activedisruptive (deny)
340145Activedisruptive (deny)
340147Activedisruptive (deny)
340148Activedisruptive (deny)
340152Activedisruptive (deny)
340156Activedisruptive (deny)
340157Activedisruptive (deny)
340247Activedisruptive (deny)
340248Activedisruptive (deny)
341099Activedisruptive (deny)
341145Activedisruptive (deny)
341245Activedisruptive (deny)
341256Activedisruptive (deny)
341266Activedisruptive (deny)
342259Activedisruptive (deny)
344360Activedisruptive (deny)
344361Activedisruptive (deny)
344363Activedisruptive (deny)
344364Activedisruptive (deny)
344366Activedisruptive (deny)
344370Activedisruptive (deny)
346755Activedisruptive (deny)
347198Activedisruptive (deny)
350147Activedisruptive (deny)
350148Activedisruptive (deny)
360147Activedisruptive (deny)
360148Activedisruptive (deny)
380026Activedisruptive (deny)
380122Activedisruptive (deny)
390572Activedisruptive (deny)
390709Activedisruptive (deny)
392301Activedisruptive (deny)
393655Activedisruptive (deny)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-104 , CAPEC-73 , CAPEC-81 , CAPEC-85