Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8255). Risk of unauthorized operations or information disclosure. CVE-2026-8255 May 11, 09:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50963). Risk of unauthorized operations or information disclosure. CVE-2022-50963 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50964). Risk of unauthorized operations or information disclosure. CVE-2022-50964 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50965). Risk of unauthorized operations or information disclosure. CVE-2022-50965 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50966). Risk of unauthorized operations or information disclosure. CVE-2022-50966 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50967). Risk of unauthorized operations or information disclosure. CVE-2022-50967 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50968). Risk of unauthorized operations or information disclosure. CVE-2022-50968 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50969). Risk of unauthorized operations or information disclosure. CVE-2022-50969 May 10, 22:16
Medium 5.4 Cross-Site Scripting (XSS) in WordPress Plugin AAWP Cross-site scripting in WordPress Plugin AAWP (CVE-2022-50970). Risk of unauthorized operations or information disclosure. CVE-2022-50970 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in Drupal avatar_uploader Cross-site scripting in Drupal avatar_uploader (CVE-2022-50957). Risk of unauthorized operations or information disclosure. CVE-2022-50957 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in WordPress Plugin Jetpack Cross-site scripting in WordPress Plugin Jetpack (CVE-2022-50958). Risk of unauthorized operations or information disclosure. CVE-2022-50958 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in WordPress Contact Form Builder Cross-site scripting in WordPress Contact Form Builder (CVE-2022-50959). Risk of unauthorized operations or information disclosure. CVE-2022-50959 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in WordPress International Sms For Contact Form 7 Integration Cross-site scripting in WordPress International Sms For Contact Form 7 Integration (CVE-2022-50960). Risk of unauthorized operations or information disclosure. CVE-2022-50960 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Plugin IP2Location Country Blocker Cross-site scripting in WordPress Plugin IP2Location Country Blocker (CVE-2022-50961). Risk of unauthorized operations or information disclosure. CVE-2022-50961 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in uBidAuction Cross-site scripting in uBidAuction (CVE-2022-50962). Risk of unauthorized operations or information disclosure. CVE-2022-50962 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress 3dady real-time web stats plugin Cross-site scripting in WordPress 3dady real-time web stats plugin (CVE-2022-50945). Risk of unauthorized operations or information disclosure. CVE-2022-50945 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Plugin Netroics Blog Posts Grid Cross-site scripting in WordPress Plugin Netroics Blog Posts Grid (CVE-2022-50946). Risk of unauthorized operations or information disclosure. CVE-2022-50946 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Plugin Testimonial Slider Cross-site scripting in WordPress Plugin Testimonial Slider (CVE-2022-50947). Risk of unauthorized operations or information disclosure. CVE-2022-50947 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Motopress Hotel Booking Lite Cross-site scripting in Motopress Hotel Booking Lite (CVE-2022-50948). Risk of unauthorized operations or information disclosure. CVE-2022-50948 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Plugin Videos sync PDF Cross-site scripting in WordPress Plugin Videos sync PDF (CVE-2022-50949). Risk of unauthorized operations or information disclosure. CVE-2022-50949 May 10, 22:16
Medium 6.4 Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated... Cross-site scripting reported (CVE-2021-47947). Risk of unauthorized operations or information disclosure. CVE-2021-47947 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Advanced Guestbook Cross-site scripting in Advanced Guestbook (CVE-2021-47950). Risk of unauthorized operations or information disclosure. CVE-2021-47950 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Picture Gallery Cross-site scripting in WordPress Picture Gallery (CVE-2021-47951). Risk of unauthorized operations or information disclosure. CVE-2021-47951 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in moodle Cross-site scripting in moodle (CVE-2022-50943). Risk of unauthorized operations or information disclosure. CVE-2022-50943 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Filterable Portfolio Gallery Cross-site scripting in Filterable Portfolio Gallery (CVE-2021-47929). Risk of unauthorized operations or information disclosure. CVE-2021-47929 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Exponent CMS Cross-site scripting in Exponent CMS (CVE-2021-47931). Risk of unauthorized operations or information disclosure. CVE-2021-47931 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Slider by Soliloquy Cross-site scripting in Slider by Soliloquy (CVE-2021-47922). Risk of unauthorized operations or information disclosure. CVE-2021-47922 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Ultimate Product Catalog Cross-site scripting in Ultimate Product Catalog (CVE-2021-47924). Risk of unauthorized operations or information disclosure. CVE-2021-47924 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in CMDBuild Cross-site scripting in CMDBuild (CVE-2021-47925). Risk of unauthorized operations or information disclosure. CVE-2021-47925 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Contact Form to Email Cross-site scripting in Contact Form to Email (CVE-2021-47926). Risk of unauthorized operations or information disclosure. CVE-2021-47926 May 10, 22:16