Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 6.4 Cross-Site Scripting (XSS) in WordPress Plugin WP Symposium Pro Cross-site scripting in WordPress Plugin WP Symposium Pro (CVE-2021-47927). Risk of unauthorized operations or information disclosure. CVE-2021-47927 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in Rocket LMS Cross-site scripting in Rocket LMS (CVE-2021-47907). Risk of unauthorized operations or information disclosure. CVE-2021-47907 May 10, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in AccessPress Social Icons Cross-site scripting in AccessPress Social Icons (CVE-2021-47910). Risk of unauthorized operations or information disclosure. CVE-2021-47910 May 10, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in libphp Cross-site scripting in libphp (CVE-2026-6735). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 8.2.31, 8.3.31, 8.4.21, 8.5.6 or later. CVE-2026-6735 May 10, 14:16
Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8219). Risk of unauthorized operations or information disclosure. CVE-2026-8219 May 10, 12:33
Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8218). Risk of unauthorized operations or information disclosure. CVE-2026-8218 May 10, 12:33
Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8221). Risk of unauthorized operations or information disclosure. CVE-2026-8221 May 10, 12:33
Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8220). Risk of unauthorized operations or information disclosure. CVE-2026-8220 May 10, 12:33
Medium 4.3 Cross-Site Scripting (XSS) in JeecgBoot Cross-site scripting in JeecgBoot (CVE-2026-8195). Risk of unauthorized operations or information disclosure. CVE-2026-8195 May 10, 06:32
High 7.8 Cross-Site Scripting (XSS) in Amazon Kiro IDE Cross-site scripting in Amazon Kiro IDE (CVE-2026-5429). Successful exploitation can lead to full system takeover. CVE-2026-5429 May 9, 23:05
Medium 5.4 Cross-Site Scripting (XSS) in Cisco Catalyst Sd Wan Manager Cross-site scripting in Cisco Catalyst Sd Wan Manager (CVE-2026-20108). Risk of unauthorized operations or information disclosure. CVE-2026-20108 May 9, 23:00
Medium 4.8 Cross-Site Scripting (XSS) in Cisco Identity Services Engine Cross-site scripting in Cisco Identity Services Engine (CVE-2025-20204). Risk of unauthorized operations or information disclosure. CVE-2025-20204 May 9, 23:00
Medium 6.1 Cross-Site Scripting (XSS) in Cisco Integrated Management Controller Cross-site scripting in Cisco Integrated Management Controller (CVE-2026-20085). Risk of unauthorized operations or information disclosure. CVE-2026-20085 May 9, 23:00
Medium 4.8 Cross-Site Scripting (XSS) in Cisco Identity Services Engine Cross-site scripting in Cisco Identity Services Engine (CVE-2026-20132). Risk of unauthorized operations or information disclosure. CVE-2026-20132 May 9, 23:00
Unrated Cross-Site Scripting (XSS) in Linkwarden Cross-site scripting in Linkwarden (CVE-2026-42455). Risk of unauthorized operations or information disclosure. Exploitable via POST /api/v1/archives/. CVE-2026-42455 May 9, 09:16
Medium 6.1 Cross-Site Scripting (XSS) in mistune Cross-site scripting in mistune (CVE-2026-44897). Risk of unauthorized operations or information disclosure. Exploitable via toc_1. Mitigation: upgrade to 3.2.1 or later. CVE-2026-44897 May 9, 09:13
Medium 6.1 Cross-Site Scripting (XSS) in mistune Cross-site scripting in mistune (CVE-2026-44896). Risk of unauthorized operations or information disclosure. Exploitable via figclass. Mitigation: upgrade to 3.2.1 or later. CVE-2026-44896 May 9, 08:43
Medium 6.1 Cross-Site Scripting (XSS) in mistune Cross-site scripting in mistune (CVE-2026-44708). Risk of unauthorized operations or information disclosure. Exploitable via _escape. CVE-2026-44708 May 9, 08:40
High 8.9 Cross-Site Scripting (XSS) in Postiz Cross-site scripting in Postiz (CVE-2026-42556). Confidential information can be exposed externally. CVE-2026-42556 May 9, 08:16
Medium 6.3 Cross-Site Scripting (XSS) in Grimmory Cross-site scripting in Grimmory (CVE-2026-42451). Confidential information can be exposed externally. CVE-2026-42451 May 9, 08:16
High 7.6 Cross-Site Scripting (XSS) in ipl/web Cross-site scripting in ipl/web (CVE-2026-42224). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 0.10.3 or later. CVE-2026-42224 May 9, 08:16
High 7.3 Cross-Site Scripting (XSS) in open-webui Cross-site scripting in open-webui (CVE-2026-44549). Confidential information can be exposed externally. Exploitable via XLSX.utils.sheet_to_html. Mitigation: upgrade to 0.8.0 or later. CVE-2026-44549 May 9, 07:26
Medium 4.8 Cross-Site Scripting (XSS) in snipe/snipe-it Cross-site scripting in snipe/snipe-it (CVE-2026-44831). Risk of unauthorized operations or information disclosure. Exploitable via notes. Mitigation: upgrade to 8.4.1 or later. CVE-2026-44831 May 9, 07:23
Medium 4.8 Cross-Site Scripting (XSS) in open-webui Cross-site scripting in open-webui (CVE-2026-44568). Risk of unauthorized operations or information disclosure. Exploitable via AccountPending.svelte. Mitigation: upgrade to 0.9.0 or later. CVE-2026-44568 May 9, 07:21
Medium 5.4 Cross-Site Scripting (XSS) in Plunk Cross-site scripting in Plunk (CVE-2026-42192). Risk of unauthorized operations or information disclosure. CVE-2026-42192 May 9, 07:16
Unrated Cross-Site Scripting (XSS) in getgrav/grav Cross-site scripting in getgrav/grav (CVE-2026-44737). Risk of unauthorized operations or information disclosure. Exploitable via GET /admin/pages/. Mitigation: upgrade to 1.7.49.5 or later. CVE-2026-44737 May 9, 04:38
Unrated Vulnerability in github.com/siyuan-note/siyuan/kernel CVE-2026-44588 May 9, 04:08
High 7.3 Cross-Site Scripting (XSS) in open-webui Cross-site scripting in open-webui (CVE-2026-44721). Confidential information can be exposed externally. Exploitable via marked. Mitigation: upgrade to 0.9.0 or later. CVE-2026-44721 May 9, 04:00
Medium 5.4 Vulnerability in github.com/modelcontextprotocol/registry CVE-2026-44429 May 9, 02:18
Critical 9.3 Cross-Site Scripting (XSS) in prestashop/prestashop Cross-site scripting in prestashop/prestashop (CVE-2026-44212). Confidential information can be exposed externally. Mitigation: upgrade to 9.1.1 or later. CVE-2026-44212 May 9, 01:54