Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,783
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894188 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 9,129

Image ID Title
CVE-2026-8896 Cross-Site Scripting (XSS) in MIR blocks and shortcodes (WordPress plugin) (CVE-2026-8896)
CVE-2026-8622 Cross-Site Scripting (XSS) in Image Sizes on Demand (WordPress plugin) (CVE-2026-8622)
CVE-2026-10091 Cross-Site Scripting (XSS) in Email JavaScript Cloak (WordPress plugin) (CVE-2026-10091)
CVE-2026-10092 Cross-Site Scripting (XSS) in Cincopa video and media plug-in (WordPress plugin) (CVE-2026-10092)
CVE-2026-3652 Cross-Site Scripting (XSS) in ARForms (WordPress plugin) (CVE-2026-3652)
CVE-2026-11614 Cross-Site Scripting (XSS) in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) (CVE-2026-11614)
CVE-2026-56785 Cross-Site Scripting (XSS) in FlatPress (CVE-2026-56785)
CVE-2026-12163 Cross-Site Scripting (XSS) in Fortra File Integrity Monitoring (CVE-2026-12163)
CVE-2026-53662 Cross-Site Scripting (XSS) in immich (CVE-2026-53662)
CVE-2026-44960 A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user...
CVE-2026-44956 Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is...
CVE-2026-34915 A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and...
CVE-2026-52807 Cross-Site Scripting (XSS) in gogs.io/gogs (CVE-2026-52807)
CVE-2026-11772 Cross-Site Scripting (XSS) in DRIMO CMS (CVE-2026-11772)
CVE-2026-56263 Cross-Site Scripting (XSS) in Crawl4AI (CVE-2026-56263)
CVE-2026-4610 Cross-Site Scripting (XSS) in ProfileGrid – User Profiles, Groups and Communities (WordPress plugin) (CVE-2026-4610)
CVE-2026-10857 Cross-Site Scripting (XSS) in e-Commerce (CVE-2026-10857)
CVE-2026-4983 Cross-Site Scripting (XSS) in Open VSX Registry (CVE-2026-4983)
CVE-2026-52798 Cross-Site Scripting (XSS) in gogs.io/gogs (CVE-2026-52798)
CVE-2026-56698 Cross-Site Scripting (XSS) in Nuxt (CVE-2026-56698)
CVE-2026-48167 Cross-Site Scripting (XSS) in filament/infolists (CVE-2026-48167)
CVE-2026-44793 Cross-Site Scripting (XSS) in org.openidentityplatform.openam:openam-federation-library (CVE-2026-44793)
CVE-2026-44203 Cross-Site Scripting (XSS) in org.openidentityplatform.openam:openam-oauth2 (CVE-2026-44203)
CVE-2026-11994 Cross-Site Scripting (XSS) in Akaunting (CVE-2026-11994)
CVE-2026-8059 Cross-Site Scripting (XSS) in IBM Datacap (CVE-2026-8059)
CVE-2026-50178 Cross-Site Scripting (XSS) in Angular Language Service (CVE-2026-50178)
CVE-2026-49241 Cross-Site Scripting (XSS) in Angular Language Service (CVE-2026-49241)
CVE-2026-11942 Cross-Site Scripting (XSS) in Akaunting (CVE-2026-11942)
CVE-2026-11943 Cross-Site Scripting (XSS) in Akaunting (CVE-2026-11943)
CVE-2026-11372 Cross-Site Scripting (XSS) in IBM TRIRIGA Application Platform (CVE-2026-11372)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details