Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,783
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894188 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 9,173

Image ID Title
CVE-2026-33244 Cross-Site Scripting (XSS) in react-router (CVE-2026-33244)
CVE-2026-7299 Cross-Site Scripting (XSS) in appsmith (CVE-2026-7299)
CVE-2026-28116 Cross-Site Scripting (XSS) in Progress Planner (CVE-2026-28116)
CVE-2026-32250 NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was…
CVE-2026-42685 Cross-Site Scripting (XSS) in WP Job Portal (CVE-2026-42685)
CVE-2026-5191 Cross-Site Scripting (XSS) in Tiled Gallery Carousel Without JetPack (WordPress plugin) (CVE-2026-5191)
CVE-2026-34907 Cross-Site Scripting (XSS) in Wirtualna Uczelnia (CVE-2026-34907)
CVE-2025-52759 Cross-Site Scripting (XSS) in Accordion FAQ (CVE-2025-52759)
CVE-2026-8885 Cross-Site Scripting (XSS) in DeMomentSomTres Shortcodes (WordPress plugin) (CVE-2026-8885)
CVE-2025-5085 Cross-Site Scripting (XSS) in WP Nano AD (WordPress plugin) (CVE-2025-5085)
CVE-2026-1451 Cross-Site Scripting (XSS) in rognone (WordPress plugin) (CVE-2026-1451)
CVE-2026-1450 Cross-Site Scripting (XSS) in rognone (WordPress plugin) (CVE-2026-1450)
CVE-2026-2382 Cross-Site Scripting (XSS) in FPW Category Thumbnails (WordPress plugin) (CVE-2026-2382)
CVE-2026-2425 Cross-Site Scripting (XSS) in hiWeb Migration Simple (WordPress plugin) (CVE-2026-2425)
CVE-2026-4080 Cross-Site Scripting (XSS) in Easy Cart (WordPress plugin) (CVE-2026-4080)
CVE-2026-4081 Cross-Site Scripting (XSS) in ZeM STL (WordPress plugin) (CVE-2026-4081)
CVE-2026-3722 Cross-Site Scripting (XSS) in WordPress (CVE-2026-3722)
CVE-2026-10567 Cross-Site Scripting (XSS) in 1Panel-dev CordysCRM (CVE-2026-10567)
CVE-2026-10510 Cross-Site Scripting (XSS) in Transsion AI Assistant Lifestyle (CVE-2026-10510)
CVE-2026-10100 Cross-Site Scripting (XSS) in Simple Custom Login Page (WordPress plugin) (CVE-2026-10100)
CVE-2026-10529 Cross-Site Scripting (XSS) in westboy CicadasCMS (CVE-2026-10529)
CVE-2026-10301 Cross-Site Scripting (XSS) in itsourcecode Fees Management System (CVE-2026-10301)
CVE-2026-10514 Cross-Site Scripting (XSS) in 1Panel-dev CordysCRM (CVE-2026-10514)
CVE-2026-24752 Cross-Site Scripting (XSS) in Kiteworks (CVE-2026-24752)
CVE-2026-24754 Cross-Site Scripting (XSS) in Kiteworks (CVE-2026-24754)
CVE-2026-10289 Cross-Site Scripting (XSS) in code-projects Hotel and Tourism Reservation System (CVE-2026-10289)
CVE-2026-24751 Cross-Site Scripting (XSS) in Kiteworks (CVE-2026-24751)
CVE-2026-42676 Cross-Site Scripting (XSS) in myCred (CVE-2026-42676)
CVE-2026-42678 Cross-Site Scripting (XSS) in GiveWP (CVE-2026-42678)
CVE-2026-42683 Cross-Site Scripting (XSS) in VikBooking Hotel Booking Engine & PMS (CVE-2026-42683)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details