Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 6.4 Cross-Site Scripting (XSS) in Robo Gallery (WordPress plugin) Cross-site scripting in Robo Gallery (WordPress plugin) (CVE-2026-4300). Risk of unauthorized operations or information disclosure. Exploitable via rbs_gallery_LoadingWord. CVE-2026-4300 Apr 8, 19:16
Medium 6.4 Cross-Site Scripting (XSS) in PrivateContent Free (WordPress plugin) Cross-site scripting in PrivateContent Free (WordPress plugin) (CVE-2026-4025). Risk of unauthorized operations or information disclosure. CVE-2026-4025 Apr 8, 19:16
Medium 6.5 Cross-Site Scripting (XSS) in UiCore Elements Cross-site scripting in UiCore Elements (CVE-2026-39708). Risk of unauthorized operations or information disclosure. CVE-2026-39708 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Elfsight WhatsApp Chat CC Cross-site scripting in Elfsight WhatsApp Chat CC (CVE-2026-39696). Risk of unauthorized operations or information disclosure. CVE-2026-39696 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Animation Addons for Elementor Cross-site scripting in Animation Addons for Elementor (CVE-2026-39702). Risk of unauthorized operations or information disclosure. CVE-2026-39702 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in WPBITS Addons For Elementor Page Builder Cross-site scripting in WPBITS Addons For Elementor Page Builder (CVE-2026-39703). Risk of unauthorized operations or information disclosure. CVE-2026-39703 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in tagDiv Composer Cross-site scripting in tagDiv Composer (CVE-2026-39692). Risk of unauthorized operations or information disclosure. CVE-2026-39692 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in FSM Custom Featured Image Caption Cross-site scripting in FSM Custom Featured Image Caption (CVE-2026-39693). Risk of unauthorized operations or information disclosure. CVE-2026-39693 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in Garden Gnome Package Cross-site scripting in Garden Gnome Package (CVE-2026-39683). Risk of unauthorized operations or information disclosure. CVE-2026-39683 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in Korea SNS Cross-site scripting in Korea SNS (CVE-2026-39667). Risk of unauthorized operations or information disclosure. CVE-2026-39667 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in MK Google Directions Cross-site scripting in MK Google Directions (CVE-2026-39674). Risk of unauthorized operations or information disclosure. CVE-2026-39674 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in SEO Friendly Images Cross-site scripting in SEO Friendly Images (CVE-2026-39665). Risk of unauthorized operations or information disclosure. CVE-2026-39665 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Hello Bar Popup Builder Cross-site scripting in Hello Bar Popup Builder (CVE-2026-39666). Risk of unauthorized operations or information disclosure. CVE-2026-39666 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in WP Simple HTML Sitemap Cross-site scripting in WP Simple HTML Sitemap (CVE-2026-39654). Risk of unauthorized operations or information disclosure. CVE-2026-39654 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Leaflet Map Cross-site scripting in Leaflet Map (CVE-2026-39646). Risk of unauthorized operations or information disclosure. CVE-2026-39646 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Livemesh Addons for Elementor Cross-site scripting in Livemesh Addons for Elementor (CVE-2026-39636). Risk of unauthorized operations or information disclosure. CVE-2026-39636 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in Qubely Cross-site scripting in Qubely (CVE-2026-39638). Risk of unauthorized operations or information disclosure. CVE-2026-39638 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in Download Manager Cross-site scripting in Download Manager (CVE-2026-39615). Risk of unauthorized operations or information disclosure. CVE-2026-39615 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in MyBookTable Bookstore Cross-site scripting in MyBookTable Bookstore (CVE-2026-39604). Risk of unauthorized operations or information disclosure. CVE-2026-39604 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Custom Query Blocks Cross-site scripting in Custom Query Blocks (CVE-2026-39575). Risk of unauthorized operations or information disclosure. CVE-2026-39575 Apr 8, 18:16
Medium 5.9 Cross-Site Scripting (XSS) in Hydra Booking Cross-site scripting in Hydra Booking (CVE-2026-39541). Risk of unauthorized operations or information disclosure. CVE-2026-39541 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Blog Filter Cross-site scripting in Blog Filter (CVE-2026-39517). Risk of unauthorized operations or information disclosure. CVE-2026-39517 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in themesflat-addons-for-elementor Cross-site scripting in themesflat-addons-for-elementor (CVE-2026-39500). Risk of unauthorized operations or information disclosure. CVE-2026-39500 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Advanced Coupons for WooCommerce Coupons Cross-site scripting in Advanced Coupons for WooCommerce Coupons (CVE-2026-39508). Risk of unauthorized operations or information disclosure. CVE-2026-39508 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in Post Expirator Cross-site scripting in Post Expirator (CVE-2026-39482). Risk of unauthorized operations or information disclosure. CVE-2026-39482 Apr 8, 18:16
Medium 6.5 Cross-Site Scripting (XSS) in One Expansion Unit vk-all-in-one-expansion-unit Cross-site scripting in One Expansion Unit vk-all-in-one-expansion-unit (CVE-2026-39483). Risk of unauthorized operations or information disclosure. CVE-2026-39483 Apr 8, 18:16
Medium 6.4 Cross-Site Scripting (XSS) in Magic Conversation For Gravity Forms (WordPress plugin) Cross-site scripting in Magic Conversation For Gravity Forms (WordPress plugin) (CVE-2026-1396). Risk of unauthorized operations or information disclosure. CVE-2026-1396 Apr 8, 18:16
Medium 6.4 Cross-Site Scripting (XSS) in Element Pack Addons for Elementor (WordPress plugin) Cross-site scripting in Element Pack Addons for Elementor (WordPress plugin) (CVE-2026-4655). Risk of unauthorized operations or information disclosure. CVE-2026-4655 Apr 8, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in Wavr (WordPress plugin) Cross-site scripting in Wavr (WordPress plugin) (CVE-2026-5506). Risk of unauthorized operations or information disclosure. Exploitable via wave. CVE-2026-5506 Apr 8, 16:16
Medium 6.4 Cross-Site Scripting (XSS) in WowPress (WordPress plugin) Cross-site scripting in WowPress (WordPress plugin) (CVE-2026-5508). Risk of unauthorized operations or information disclosure. Exploitable via wowpress. CVE-2026-5508 Apr 8, 16:16