Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 4.3 Cross-Site Scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System Cross-site scripting in SourceCodester Pharmacy Sales and Inventory System (CVE-2026-7200). Risk of unauthorized operations or information disclosure. CVE-2026-7200 Apr 28, 09:16
Medium 5.4 Cross-Site Scripting (XSS) in pimcore Cross-site scripting in pimcore (CVE-2026-5362). Risk of unauthorized operations or information disclosure. CVE-2026-5362 Apr 28, 06:16
Medium 6.1 A reflected cross-site scripting (XSS) vulnerability exists in diskover-community Cross-site scripting reported (CVE-2026-38935). Risk of unauthorized operations or information disclosure. CVE-2026-38935 Apr 28, 02:16
Medium 6.1 A reflected cross-site scripting (XSS) vulnerability exists in diskover-community Cross-site scripting reported (CVE-2026-38936). Risk of unauthorized operations or information disclosure. CVE-2026-38936 Apr 28, 02:16
Low 2.4 Cross-Site Scripting (XSS) in BIVOCOM TR321 Cross-site scripting in BIVOCOM TR321 (CVE-2026-6999). Risk of unauthorized operations or information disclosure. CVE-2026-6999 Apr 26, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Cyberpanel Cross-site scripting in Cyberpanel (CVE-2026-41472). Risk of unauthorized operations or information disclosure. Exploitable via POST /api/ai-scanner/callback. CVE-2026-41472 Apr 25, 06:16
Medium 6.4 Cross-Site Scripting (XSS) in Royal Elementor Addons (WordPress plugin) Cross-site scripting in Royal Elementor Addons (WordPress plugin) (CVE-2026-5428). Risk of unauthorized operations or information disclosure. CVE-2026-5428 Apr 24, 15:16
Medium 6.5 Cross-Site Scripting (XSS) in Rescue Shortcodes Cross-site scripting in Rescue Shortcodes (CVE-2025-62110). Risk of unauthorized operations or information disclosure. CVE-2025-62110 Apr 23, 21:17
Medium 5.4 Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an... Cross-site scripting reported (CVE-2026-3007). Risk of unauthorized operations or information disclosure. CVE-2026-3007 Apr 23, 13:16
Medium 5.4 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2026-3837). Risk of unauthorized operations or information disclosure. CVE-2026-3837 Apr 23, 06:32
Medium 5.4 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2026-3673). Risk of unauthorized operations or information disclosure. CVE-2026-3673 Apr 23, 05:16
Medium 6.1 Cross-Site Scripting (XSS) in ICEWARP Cross-site scripting in ICEWARP (CVE-2018-25269). Risk of unauthorized operations or information disclosure. CVE-2018-25269 Apr 23, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in DeepL Chrome browser extension Cross-site scripting in DeepL Chrome browser extension (CVE-2026-40451). Risk of unauthorized operations or information disclosure. CVE-2026-40451 Apr 22, 14:16
Unrated Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that… Cross-site scripting reported (CVE-2026-41456). Risk of unauthorized operations or information disclosure. CVE-2026-41456 Apr 22, 04:16
Medium 6.1 Cross-Site Scripting (XSS) in Sale Cross-site scripting in Sale (CVE-2025-41011). Risk of unauthorized operations or information disclosure. CVE-2025-41011 Apr 22, 01:16
Unrated Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to… Cross-site scripting reported (CVE-2025-10354). Risk of unauthorized operations or information disclosure. CVE-2025-10354 Apr 22, 00:16
Unrated Cross-Site Scripting (XSS) in Navigate Content Management System Cross-site scripting in Navigate Content Management System (CVE-2026-3317). Risk of unauthorized operations or information disclosure. CVE-2026-3317 Apr 21, 19:16
Medium 5.4 Cross-Site Scripting (XSS) in Vvveb Cross-site scripting in Vvveb (CVE-2026-34429). Risk of unauthorized operations or information disclosure. CVE-2026-34429 Apr 21, 01:16
Low 3.5 Cross-Site Scripting (XSS) in Email Encoder (WordPress plugin) Cross-site scripting in Email Encoder (WordPress plugin) (CVE-2024-7083). Risk of unauthorized operations or information disclosure. CVE-2024-7083 Apr 20, 16:16
Exploited High Cross-Site Scripting (XSS) in Synacor zimbra-collaboration-suite-zcs cross-site scripting in Synacor zimbra-collaboration-suite-zcs (CVE-2025-48700). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. CVE-2025-48700 Apr 20, 09:00
Low 3.1 Vulnerability in Stirling-PDF CVE-2026-33436 Apr 18, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Wso2 Api Manager Cross-site scripting in Wso2 Api Manager (CVE-2025-6024). Risk of unauthorized operations or information disclosure. CVE-2025-6024 Apr 16, 19:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13364). Risk of unauthorized operations or information disclosure. CVE-2025-13364 Apr 16, 16:16
Medium 6.4 Cross-Site Scripting (XSS) in WP Shortcodes Plugin — Shortcodes Ultimate (WordPress plugin) Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (WordPress plugin) (CVE-2026-3885). Risk of unauthorized operations or information disclosure. CVE-2026-3885 Apr 16, 12:16
Medium 4.3 Cross-Site Scripting (XSS) in hono Cross-site scripting in hono (CVE-2026-56761). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.12.14 or later. CVE-2026-56761 Apr 16, 10:02
Medium 6.5 Cross-Site Scripting (XSS) in YouTube Showcase Cross-site scripting in YouTube Showcase (CVE-2025-15636). Risk of unauthorized operations or information disclosure. CVE-2025-15636 Apr 16, 02:17
High 8.9 A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality... Cross-site scripting reported (CVE-2025-40899). Data can be tampered with by attackers. CVE-2025-40899 Apr 15, 18:16
Medium 5.4 Cross-Site Scripting (XSS) in GROWI Cross-site scripting in GROWI (CVE-2026-26291). Risk of unauthorized operations or information disclosure. CVE-2026-26291 Apr 15, 14:16
Medium 4.8 Cross-Site Scripting (XSS) in october/rain Cross-site scripting in october/rain (CVE-2026-25133). Risk of unauthorized operations or information disclosure. Exploitable via media.library.create. Mitigation: upgrade to 3.7.14 or later. CVE-2026-25133 Apr 15, 07:29
Medium 5.4 Cross-Site Scripting (XSS) in Docmost Cross-site scripting in Docmost (CVE-2026-34212). Risk of unauthorized operations or information disclosure. CVE-2026-34212 Apr 15, 07:16