Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Unrated Vulnerability in github.com/siyuan-note/siyuan/kernel CVE-2026-44670 May 9, 01:53
High 7.5 Vulnerability in locize CVE-2026-41886 May 9, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in absinthe_plug Cross-site scripting in absinthe_plug (CVE-2026-42794). Risk of unauthorized operations or information disclosure. CVE-2026-42794 May 9, 01:16
Medium 6.4 Cross-Site Scripting (XSS) in marko Cross-site scripting in marko (CVE-2026-41591). Risk of unauthorized operations or information disclosure. Exploitable via _escape_script. Mitigation: upgrade to 5.38.36 or later. CVE-2026-41591 May 9, 01:16
High 8.6 Vulnerability in i18next-http-middleware CVE-2026-41683 May 9, 01:16
High 8.7 Cross-Site Scripting (XSS) in Laravel Brave CMS Cross-site scripting in Laravel Brave CMS (CVE-2026-41524). Confidential information can be exposed externally. CVE-2026-41524 May 9, 00:16
Medium 6.1 Cross-Site Scripting (XSS) in Th30D4Y Cross-site scripting in Th30D4Y (CVE-2026-41575). Risk of unauthorized operations or information disclosure. CVE-2026-41575 May 9, 00:16
High 7.1 Cross-Site Scripting (XSS) in Brave CMS Cross-site scripting in Brave CMS (CVE-2026-41576). Confidential information can be exposed externally. CVE-2026-41576 May 9, 00:16
Medium 6.4 Cross-Site Scripting (XSS) in Sky Addons (WordPress plugin) Cross-site scripting in Sky Addons (WordPress plugin) (CVE-2026-7475). Risk of unauthorized operations or information disclosure. Exploitable via sky_script_content. CVE-2026-7475 May 8, 19:16
Medium 6.4 Cross-Site Scripting (XSS) in E2Pdf – Export Pdf Tool for (WordPress plugin) Cross-site scripting in E2Pdf – Export Pdf Tool for (WordPress plugin) (CVE-2026-7650). Risk of unauthorized operations or information disclosure. CVE-2026-7650 May 8, 19:16
Medium 6.4 Cross-Site Scripting (XSS) in NMR Strava activities (WordPress plugin) Cross-site scripting in NMR Strava activities (WordPress plugin) (CVE-2026-5341). Risk of unauthorized operations or information disclosure. Exploitable via strava_nmr_connect. CVE-2026-5341 May 8, 19:16
High 7.2 Cross-Site Scripting (XSS) in Auto Affiliate Links (WordPress plugin) Cross-site scripting in Auto Affiliate Links (WordPress plugin) (CVE-2026-7330). Risk of unauthorized operations or information disclosure. CVE-2026-7330 May 8, 18:16
Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2024-33724). Risk of unauthorized operations or information disclosure. CVE-2024-33724 May 8, 15:16
Medium 6.1 Cross-Site Scripting (XSS) in org.opencms:opencms-core Cross-site scripting in org.opencms:opencms-core (CVE-2023-42343). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 16.0 or later. CVE-2023-42343 May 8, 14:16
Medium 6.1 Cross-Site Scripting (XSS) in org.opencms:opencms-core Cross-site scripting in org.opencms:opencms-core (CVE-2023-42345). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 16.0 or later. CVE-2023-42345 May 8, 14:16
Medium 6.1 Cross-Site Scripting (XSS) in Thruk Monitoring Cross-site scripting in Thruk Monitoring (CVE-2022-23961). Risk of unauthorized operations or information disclosure. CVE-2022-23961 May 8, 14:16
Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System Cross-site scripting in SourceCodester Pharmacy Sales and Inventory System (CVE-2026-8136). Risk of unauthorized operations or information disclosure. CVE-2026-8136 May 8, 13:16
Medium 5.1 Cross-Site Scripting (XSS) in wlc Cross-site scripting in wlc (CVE-2026-42150). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.0.0 or later. CVE-2026-42150 May 8, 13:16
Medium 4.3 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-8117). Risk of unauthorized operations or information disclosure. CVE-2026-8117 May 8, 09:16
Medium 6.1 Cross-Site Scripting (XSS) in Github Cross-site scripting in Github (CVE-2026-8106). Risk of unauthorized operations or information disclosure. CVE-2026-8106 May 8, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in Vvveb Cross-site scripting in Vvveb (CVE-2026-41929). Risk of unauthorized operations or information disclosure. CVE-2026-41929 May 8, 07:16
High 8.8 Cross-Site Scripting (XSS) in Azure Machine Learning Cross-site scripting in Azure Machine Learning (CVE-2026-32207). Successful exploitation can lead to full system takeover. CVE-2026-32207 May 8, 07:16
High 7.2 Cross-Site Scripting (XSS) in postorius Cross-site scripting in postorius (CVE-2026-44742). Risk of unauthorized operations or information disclosure. CVE-2026-44742 May 8, 06:30
Medium 4.7 Cross-Site Scripting (XSS) in i18nextify Cross-site scripting in i18nextify (CVE-2026-41692). Risk of unauthorized operations or information disclosure. Exploitable via i18nextify. Mitigation: upgrade to 4.0.8 or later. CVE-2026-41692 May 8, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in golang Cross-site scripting in golang (CVE-2026-39823). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.25.10, 1.26.3 or later. CVE-2026-39823 May 8, 05:16
Medium 5.4 A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the… Cross-site scripting reported (CVE-2026-36388). Risk of unauthorized operations or information disclosure. CVE-2026-36388 May 8, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in sidekiq-cron Cross-site scripting in sidekiq-cron (CVE-2025-67202). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.4.0 or later. CVE-2025-67202 May 8, 00:16
Medium 5.4 Cross-Site Scripting (XSS) in Misp Cross-site scripting in Misp (CVE-2026-8080). Risk of unauthorized operations or information disclosure. CVE-2026-8080 May 7, 21:31
Medium 5.9 Cross-Site Scripting (XSS) in WEN Logo Slider Cross-site scripting in WEN Logo Slider (CVE-2025-62127). Risk of unauthorized operations or information disclosure. CVE-2025-62127 May 7, 18:16
Low 3.1 Cross-Site Scripting (XSS) in java Cross-site scripting in java (CVE-2026-21947). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.8.0, 8.0.481 or later. CVE-2026-21947 May 6, 23:46