CWE-177 - Improper Handling of URL Encoding (Hex Encoding)
- Abstraction:Variant
- Structure:Simple
- Status:Draft
- Release Date:2006-07-19
- Latest Modification Date:2023-06-29
Weakness Name
Improper Handling of URL Encoding (Hex Encoding)
Description
The product does not properly handle when all or part of an input has been URL encoded.
Common Consequences
Scope: Integrity
Impact: Unexpected State
Related Weaknesses
Oracle denies breach after hacker claims theft of 6 million data records
Microsoft confirms it's killing off Skype in May, after 14 years
Fake "Security Alert" issues on GitHub use OAuth app to hijack accounts
Critical Veeam Backup & Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120)
New Windows zero-day exploited by 11 state hacking groups since 2017
GitHub Action supply chain attack exposed secrets in 218 repos
NAKIVO Backup & Replication vulnerability exploited by attackers (CVE-2024-48248)
Microsoft Trusted Signing service abused to code-sign malware
CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks
SideWinder APT Targets Maritime, Nuclear, and IT Sectors Across Asia, Middle East, and Africa
CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability
CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability
CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability
CVE-2025-22224 VMware ESXi and Workstation TOCTOU Race Condition Vulnerability
CVE-2024-49035 Microsoft Partner Center Improper Access Control Vulnerability
CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability
CVE-2025-24201 Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion Vulnerability
InformationalInformation Disclosure - Suspicious Comments
InformationalRe-examine Cache-control Directives