Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 9,173
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

🛡 Vulnerabilities tagged with this 9,184

Image ID Title
CVE-2025-14773 Cross-Site Scripting (XSS) in T-MAC Plus (CVE-2025-14773)
CVE-2025-15654 Cross-Site Scripting (XSS) in Prague (CVE-2025-15654)
CVE-2026-7421 Cross-Site Scripting (XSS) in Passeum Ticketing (WordPress plugin) (CVE-2026-7421)
CVE-2026-40108 Cross-Site Scripting (XSS) in GLPI (CVE-2026-40108)
CVE-2026-35212 Cross-Site Scripting (XSS) in pycti (CVE-2026-35212)
CVE-2026-42849 Cross-Site Scripting (XSS) in authentik (CVE-2026-42849)
CVE-2026-5385 Cross-Site Scripting (XSS) in glpi (CVE-2026-5385)
CVE-2026-30586 Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain...
CVE-2026-33245 Cross-Site Scripting (XSS) in react-router (CVE-2026-33245)
CVE-2026-33553 Cross-Site Scripting (XSS) in Northern.tech CFEngine Enterprise (CVE-2026-33553)
CVE-2026-33244 Cross-Site Scripting (XSS) in react-router (CVE-2026-33244)
CVE-2026-7299 Cross-Site Scripting (XSS) in appsmith (CVE-2026-7299)
CVE-2026-28116 Cross-Site Scripting (XSS) in Progress Planner (CVE-2026-28116)
CVE-2026-32250 NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was…
CVE-2026-42685 Cross-Site Scripting (XSS) in WP Job Portal (CVE-2026-42685)
CVE-2026-5191 Cross-Site Scripting (XSS) in Tiled Gallery Carousel Without JetPack (WordPress plugin) (CVE-2026-5191)
CVE-2026-34907 Cross-Site Scripting (XSS) in Wirtualna Uczelnia (CVE-2026-34907)
CVE-2025-52759 Cross-Site Scripting (XSS) in Accordion FAQ (CVE-2025-52759)
CVE-2026-8885 Cross-Site Scripting (XSS) in DeMomentSomTres Shortcodes (WordPress plugin) (CVE-2026-8885)
CVE-2025-5085 Cross-Site Scripting (XSS) in WP Nano AD (WordPress plugin) (CVE-2025-5085)
CVE-2026-1451 Cross-Site Scripting (XSS) in rognone (WordPress plugin) (CVE-2026-1451)
CVE-2026-1450 Cross-Site Scripting (XSS) in rognone (WordPress plugin) (CVE-2026-1450)
CVE-2026-2382 Cross-Site Scripting (XSS) in FPW Category Thumbnails (WordPress plugin) (CVE-2026-2382)
CVE-2026-2425 Cross-Site Scripting (XSS) in hiWeb Migration Simple (WordPress plugin) (CVE-2026-2425)
CVE-2026-4080 Cross-Site Scripting (XSS) in Easy Cart (WordPress plugin) (CVE-2026-4080)
CVE-2026-4081 Cross-Site Scripting (XSS) in ZeM STL (WordPress plugin) (CVE-2026-4081)
CVE-2026-3722 Cross-Site Scripting (XSS) in WordPress (CVE-2026-3722)
CVE-2026-10567 Cross-Site Scripting (XSS) in 1Panel-dev CordysCRM (CVE-2026-10567)
CVE-2026-10510 Cross-Site Scripting (XSS) in Transsion AI Assistant Lifestyle (CVE-2026-10510)
CVE-2026-10100 Cross-Site Scripting (XSS) in Simple Custom Login Page (WordPress plugin) (CVE-2026-10100)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details