Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 4.6 Cross-Site Scripting (XSS) in Docmost Cross-site scripting in Docmost (CVE-2026-33193). Risk of unauthorized operations or information disclosure. CVE-2026-33193 Apr 15, 07:16
Medium 5.4 Cross-Site Scripting (XSS) in Chamilo LMS Cross-site scripting in Chamilo LMS (CVE-2026-34161). Risk of unauthorized operations or information disclosure. CVE-2026-34161 Apr 15, 06:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27222). Risk of unauthorized operations or information disclosure. CVE-2026-27222 Apr 15, 05:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-34624). Risk of unauthorized operations or information disclosure. CVE-2026-34624 Apr 15, 04:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-34625). Risk of unauthorized operations or information disclosure. CVE-2026-34625 Apr 15, 04:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-34623). Risk of unauthorized operations or information disclosure. CVE-2026-34623 Apr 15, 04:16
Medium 6.1 Cross-Site Scripting (XSS) in /studentms/admin/contact-us.php Cross-site scripting in /studentms/admin/contact-us.php (CVE-2025-65134). Risk of unauthorized operations or information disclosure. CVE-2025-65134 Apr 15, 03:30
Medium 6.1 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-34614). Risk of unauthorized operations or information disclosure. CVE-2026-34614 Apr 15, 03:17
High 8.7 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-34617). Confidential information can be exposed externally. CVE-2026-34617 Apr 15, 03:17
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27288). Risk of unauthorized operations or information disclosure. CVE-2026-27288 Apr 15, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in DNG SDK Cross-site scripting in DNG SDK (CVE-2026-27258). Risk of unauthorized operations or information disclosure. CVE-2026-27258 Apr 15, 03:16
Critical 9.3 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27246). Confidential information can be exposed externally. CVE-2026-27246 Apr 15, 03:16
Critical 9.3 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27245). Confidential information can be exposed externally. CVE-2026-27245 Apr 15, 03:16
Critical 9.3 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27243). Confidential information can be exposed externally. CVE-2026-27243 Apr 15, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-21331). Risk of unauthorized operations or information disclosure. CVE-2026-21331 Apr 15, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in Fortinet FortiSandbox Cross-site scripting in Fortinet FortiSandbox (CVE-2025-61886). Risk of unauthorized operations or information disclosure. CVE-2025-61886 Apr 15, 01:16
Medium 6.9 Cross-Site Scripting (XSS) in Keycloak Cross-site scripting in Keycloak (CVE-2026-37980). Confidential information can be exposed externally. Exploitable via organization.alias. CVE-2026-37980 Apr 15, 00:16
Medium 5.4 Cross-Site Scripting (XSS) in Snipe-IT web-based asset management system v8.3.0 to up Cross-site scripting in Snipe-IT web-based asset management system v8.3.0 to up (CVE-2025-63743). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 8.3.2 or later. CVE-2025-63743 Apr 14, 01:16
Low 3.5 Cross-Site Scripting (XSS) in 1Panel-dev MaxKB Cross-site scripting in 1Panel-dev MaxKB (CVE-2025-15632). Risk of unauthorized operations or information disclosure. CVE-2025-15632 Apr 13, 19:16
Medium 5.4 Cross-Site Scripting (XSS) in NightWolf Penetration Testing Platform Cross-site scripting in NightWolf Penetration Testing Platform (CVE-2026-6179). Risk of unauthorized operations or information disclosure. CVE-2026-6179 Apr 13, 12:30
Critical 9.3 Cross-Site Scripting (XSS) in Rukovoditel CRM Cross-site scripting in Rukovoditel CRM (CVE-2026-31845). Confidential information can be exposed externally. CVE-2026-31845 Apr 12, 04:16
High 7.1 Cross-Site Scripting (XSS) in Cerato Cross-site scripting in Cerato (CVE-2025-58920). Risk of unauthorized operations or information disclosure. CVE-2025-58920 Apr 10, 23:16
Medium 6.1 Cross-Site Scripting (XSS) in Juniper Networks Junos Space Cross-site scripting in Juniper Networks Junos Space (CVE-2026-21904). Risk of unauthorized operations or information disclosure. CVE-2026-21904 Apr 10, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in Joomla HikaShop Cross-site scripting in Joomla HikaShop (CVE-2023-54364). Risk of unauthorized operations or information disclosure. CVE-2023-54364 Apr 10, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Joomla Solidres Cross-site scripting in Joomla Solidres (CVE-2023-54363). Risk of unauthorized operations or information disclosure. CVE-2023-54363 Apr 10, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Joomla VirtueMart Shopping-Cart Cross-site scripting in Joomla VirtueMart Shopping-Cart (CVE-2023-54362). Risk of unauthorized operations or information disclosure. CVE-2023-54362 Apr 10, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Joomla iProperty Real Estate Cross-site scripting in Joomla iProperty Real Estate (CVE-2023-54361). Risk of unauthorized operations or information disclosure. CVE-2023-54361 Apr 10, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Joomla JLex Review Cross-site scripting in Joomla JLex Review (CVE-2023-54360). Risk of unauthorized operations or information disclosure. CVE-2023-54360 Apr 10, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in WordPress adivaha Travel Plugin Cross-site scripting in WordPress adivaha Travel Plugin (CVE-2023-54358). Risk of unauthorized operations or information disclosure. CVE-2023-54358 Apr 10, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Limesurvey Cross-site scripting in Limesurvey (CVE-2025-63238). Risk of unauthorized operations or information disclosure. CVE-2025-63238 Apr 10, 03:16