Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 4.4 Cross-Site Scripting (XSS) in Inquiry Form to Posts or Pages (WordPress plugin) Cross-site scripting in Inquiry Form to Posts or Pages (WordPress plugin) (CVE-2026-5169). Risk of unauthorized operations or information disclosure. CVE-2026-5169 Apr 8, 16:16
Medium 6.4 Cross-Site Scripting (XSS) in Sports Club Management (WordPress plugin) Cross-site scripting in Sports Club Management (WordPress plugin) (CVE-2026-4871). Risk of unauthorized operations or information disclosure. Exploitable via scm_member_data. CVE-2026-4871 Apr 8, 16:16
Medium 6.4 Cross-Site Scripting (XSS) in Columns by BestWebSoft (WordPress plugin) Cross-site scripting in Columns by BestWebSoft (WordPress plugin) (CVE-2026-3618). Risk of unauthorized operations or information disclosure. CVE-2026-3618 Apr 8, 16:16
Medium 4.4 Cross-Site Scripting (XSS) in Whole Enquiry Cart for WooCommerce (WordPress plugin) Cross-site scripting in Whole Enquiry Cart for WooCommerce (WordPress plugin) (CVE-2026-2838). Risk of unauthorized operations or information disclosure. CVE-2026-2838 Apr 8, 16:16
Medium 6.4 Cross-Site Scripting (XSS) in Pinterest Site Verification plugin using Meta Tag (WordPress plugin) Cross-site scripting in Pinterest Site Verification plugin using Meta Tag (WordPress plugin) (CVE-2026-3142). Risk of unauthorized operations or information disclosure. CVE-2026-3142 Apr 8, 16:16
Medium 5.4 Cross-Site Scripting (XSS) in AM LottiePlayer (WordPress plugin) Cross-site scripting in AM LottiePlayer (WordPress plugin) (CVE-2025-1794). Risk of unauthorized operations or information disclosure. CVE-2025-1794 Apr 8, 16:16
Medium 5.4 Cross-Site Scripting (XSS) in MATCHA SNS Cross-site scripting in MATCHA SNS (CVE-2026-27787). Risk of unauthorized operations or information disclosure. CVE-2026-27787 Apr 8, 15:16
Medium 6.4 Cross-Site Scripting (XSS) in LearnPress – WordPress LMS Plugin (WordPress plugin) Cross-site scripting in LearnPress – WordPress LMS Plugin (WordPress plugin) (CVE-2026-4333). Risk of unauthorized operations or information disclosure. CVE-2026-4333 Apr 8, 14:16
Medium 6.4 Cross-Site Scripting (XSS) in Prime Slider – Addons for Elementor (WordPress plugin) Cross-site scripting in Prime Slider – Addons for Elementor (WordPress plugin) (CVE-2026-4341). Risk of unauthorized operations or information disclosure. Exploitable via follow_us_text. CVE-2026-4341 Apr 8, 14:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-4785). Risk of unauthorized operations or information disclosure. CVE-2026-4785 Apr 8, 14:16
Medium 6.4 Cross-Site Scripting (XSS) in TableOn – WordPress Posts Table Filterable (WordPress plugin) Cross-site scripting in TableOn – WordPress Posts Table Filterable (WordPress plugin) (CVE-2026-3513). Risk of unauthorized operations or information disclosure. CVE-2026-3513 Apr 8, 14:16
Medium 6.4 Cross-Site Scripting (XSS) in Investi (WordPress plugin) Cross-site scripting in Investi (WordPress plugin) (CVE-2026-3600). Risk of unauthorized operations or information disclosure. CVE-2026-3600 Apr 8, 14:16
Medium 6.4 Cross-Site Scripting (XSS) in Strong Testimonials (WordPress plugin) Cross-site scripting in Strong Testimonials (WordPress plugin) (CVE-2026-3239). Risk of unauthorized operations or information disclosure. CVE-2026-3239 Apr 8, 14:16
Medium 6.4 Cross-Site Scripting (XSS) in LightPress Lightbox (WordPress plugin) Cross-site scripting in LightPress Lightbox (WordPress plugin) (CVE-2026-4379). Risk of unauthorized operations or information disclosure. Exploitable via group. CVE-2026-4379 Apr 8, 13:17
Medium 6.4 Cross-Site Scripting (XSS) in Blubrry PowerPress (WordPress plugin) Cross-site scripting in Blubrry PowerPress (WordPress plugin) (CVE-2026-2988). Risk of unauthorized operations or information disclosure. CVE-2026-2988 Apr 8, 13:17
Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation Mediawiki - CampaignEvents Extension Cross-site scripting in Wikimedia Foundation Mediawiki - CampaignEvents Extension (CVE-2026-39935). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39935 Apr 8, 08:16
Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation Mediawiki - Score Extension Cross-site scripting in Wikimedia Foundation Mediawiki - Score Extension (CVE-2026-39936). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39936 Apr 8, 08:16
Medium 6.1 Cross-Site Scripting (XSS) in stdlib Cross-site scripting in stdlib (CVE-2026-32289). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.25.9, 1.26.2 or later. CVE-2026-32289 Apr 8, 07:53
Critical 9.0 Cross-Site Scripting (XSS) in github.com/siyuan-note/siyuan/kernel Cross-site scripting in github.com/siyuan-note/siyuan/kernel (CVE-2026-39846). Successful exploitation can lead to full system takeover. Exploitable via nodeIntegration. Mitigation: upgrade to 0.0.0-20260407035653-2f416e5253f1 or later. CVE-2026-39846 Apr 8, 07:16
Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation Mediawiki - GlobalWatchlist Extension Cross-site scripting in Wikimedia Foundation Mediawiki - GlobalWatchlist Extension (CVE-2026-39933). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39933 Apr 8, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in Cronicle Cross-site scripting in Cronicle (CVE-2026-39400). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 0.9.111 or later. CVE-2026-39400 Apr 8, 06:17
Medium 6.1 Vulnerability in Mediawiki - Cargo Extension CVE-2026-39841 Apr 8, 05:16
Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation MediaWiki - ProofreadPage Extension Cross-site scripting in Wikimedia Foundation MediaWiki - ProofreadPage Extension (CVE-2026-39838). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39838 Apr 8, 05:16
Medium 5.4 Cross-Site Scripting (XSS) in Stock Locations configuration feature Cross-site scripting in Stock Locations configuration feature (CVE-2026-39380). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.4.3 or later. CVE-2026-39380 Apr 8, 05:16
Medium 5.4 Cross-Site Scripting (XSS) in WWBN AVideo Cross-site scripting in WWBN AVideo (CVE-2026-39367). Risk of unauthorized operations or information disclosure. CVE-2026-39367 Apr 8, 05:16
High 8.1 Cross-Site Scripting (XSS) in ChurchCRM Cross-site scripting in ChurchCRM (CVE-2026-39344). Confidential information can be exposed externally. Mitigation: upgrade to 7.1.0 or later. CVE-2026-39344 Apr 8, 03:16
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Online Hotel Booking Cross-site scripting in code-projects Online Hotel Booking (CVE-2026-5705). Risk of unauthorized operations or information disclosure. CVE-2026-5705 Apr 7, 09:16
Medium 5.4 Cross-Site Scripting (XSS) in OCS Inventory NG Server Cross-site scripting in OCS Inventory NG Server (CVE-2026-22675). Risk of unauthorized operations or information disclosure. Exploitable via User-Agent header. CVE-2026-22675 Apr 7, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2026-35399). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.6.9 or later. CVE-2026-35399 Apr 7, 06:16
Medium 5.4 Cross-Site Scripting (XSS) in Lichess Cross-site scripting in Lichess (CVE-2026-35208). Risk of unauthorized operations or information disclosure. CVE-2026-35208 Apr 7, 06:16