Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

Medium 5.4 Cross-Site Scripting (XSS) in Lichess Cross-site scripting in Lichess (CVE-2026-35208). Risk of unauthorized operations or information disclosure. CVE-2026-35208 Apr 7, 06:16
Medium 5.4 Cross-Site Scripting (XSS) in Webmail Cross-site scripting in Webmail (CVE-2026-35390). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.4.11 or later. CVE-2026-35390 Apr 7, 06:16
Medium 4.3 Cross-Site Scripting (XSS) in Cyber-III Student-Management-System Cross-site scripting in Cyber-III Student-Management-System (CVE-2026-5671). Risk of unauthorized operations or information disclosure. CVE-2026-5671 Apr 7, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in Feehi CMS Cross-site scripting in Feehi CMS (CVE-2026-31313). Risk of unauthorized operations or information disclosure. CVE-2026-31313 Apr 7, 02:17
Medium 5.4 Cross-Site Scripting (XSS) in Bynder Cross-site scripting in Bynder (CVE-2026-31153). Risk of unauthorized operations or information disclosure. CVE-2026-31153 Apr 7, 00:17
Medium 4.3 Cross-Site Scripting (XSS) in assafelovic gpt-researcher Cross-site scripting in assafelovic gpt-researcher (CVE-2026-5630). Risk of unauthorized operations or information disclosure. CVE-2026-5630 Apr 6, 16:16
Medium 4.3 Cross-Site Scripting (XSS) in assafelovic gpt-researcher Cross-site scripting in assafelovic gpt-researcher (CVE-2026-5625). Risk of unauthorized operations or information disclosure. CVE-2026-5625 Apr 6, 15:16
Medium 4.3 Cross-Site Scripting (XSS) in givanz Vvvebjs Cross-site scripting in givanz Vvvebjs (CVE-2026-5615). Risk of unauthorized operations or information disclosure. CVE-2026-5615 Apr 6, 13:16
High 8.2 Cross-Site Scripting (XSS) in Ask Expert Script Cross-site scripting in Ask Expert Script (CVE-2019-25676). Confidential information can be exposed externally. CVE-2019-25676 Apr 6, 06:16
Low 3.5 Cross-Site Scripting (XSS) in Akaunting Cross-site scripting in Akaunting (CVE-2026-5568). Risk of unauthorized operations or information disclosure. CVE-2026-5568 Apr 5, 22:17
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5541). Risk of unauthorized operations or information disclosure. CVE-2026-5541 Apr 5, 14:16
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5542). Risk of unauthorized operations or information disclosure. CVE-2026-5542 Apr 5, 14:16
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5539). Risk of unauthorized operations or information disclosure. CVE-2026-5539 Apr 5, 13:16
Medium 4.3 Cross-Site Scripting (XSS) in badlogic pi-mono Cross-site scripting in badlogic pi-mono (CVE-2026-5533). Risk of unauthorized operations or information disclosure. CVE-2026-5533 Apr 5, 11:16
Medium 4.3 Cross-Site Scripting (XSS) in Nodcms Cross-site scripting in Nodcms (CVE-2016-20054). Risk of unauthorized operations or information disclosure. CVE-2016-20054 Apr 5, 05:16
High 7.2 Cross-Site Scripting (XSS) in MyBB Last User Cross-site scripting in MyBB Last User (CVE-2018-25250). Risk of unauthorized operations or information disclosure. CVE-2018-25250 Apr 4, 23:16
Medium 6.1 Cross-Site Scripting (XSS) in MyBB Like Plugin Cross-site scripting in MyBB Like Plugin (CVE-2018-25247). Risk of unauthorized operations or information disclosure. CVE-2018-25247 Apr 4, 23:16
High 7.2 Cross-Site Scripting (XSS) in MyBB Downloads Plugin Cross-site scripting in MyBB Downloads Plugin (CVE-2018-25248). Risk of unauthorized operations or information disclosure. CVE-2018-25248 Apr 4, 23:16
Medium 6.4 Cross-Site Scripting (XSS) in MyBB My Arcade Plugin Cross-site scripting in MyBB My Arcade Plugin (CVE-2018-25249). Risk of unauthorized operations or information disclosure. CVE-2018-25249 Apr 4, 23:16
High 7.2 Cross-Site Scripting (XSS) in Visitor Traffic Real Time Statistics (WordPress plugin) Cross-site scripting in Visitor Traffic Real Time Statistics (WordPress plugin) (CVE-2026-2936). Risk of unauthorized operations or information disclosure. CVE-2026-2936 Apr 4, 21:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-0626). Risk of unauthorized operations or information disclosure. CVE-2026-0626 Apr 4, 21:16
High 7.2 Cross-Site Scripting (XSS) in Widgets for Social Photo Feed (WordPress plugin) Cross-site scripting in Widgets for Social Photo Feed (WordPress plugin) (CVE-2026-5425). Risk of unauthorized operations or information disclosure. CVE-2026-5425 Apr 4, 18:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-2437). Risk of unauthorized operations or information disclosure. CVE-2026-2437 Apr 4, 18:16
Medium 6.4 Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) Cross-site scripting in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) (CVE-2026-0737). Risk of unauthorized operations or information disclosure. CVE-2026-0737 Apr 4, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) Cross-site scripting in WP Shortcodes Plugin - Shortcodes Ultimate (WordPress plugin) (CVE-2026-0738). Risk of unauthorized operations or information disclosure. CVE-2026-0738 Apr 4, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in ElementsKit Elementor Addons and Templates (WordPress plugin) Cross-site scripting in ElementsKit Elementor Addons and Templates (WordPress plugin) (CVE-2026-2600). Risk of unauthorized operations or information disclosure. CVE-2026-2600 Apr 4, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-15064). Risk of unauthorized operations or information disclosure. CVE-2025-15064 Apr 4, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in Simple Shopping Cart (WordPress plugin) Cross-site scripting in Simple Shopping Cart (WordPress plugin) (CVE-2026-0552). Risk of unauthorized operations or information disclosure. CVE-2026-0552 Apr 4, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in Royal Addons for Elementor (WordPress plugin) Cross-site scripting in Royal Addons for Elementor (WordPress plugin) (CVE-2026-0664). Risk of unauthorized operations or information disclosure. CVE-2026-0664 Apr 4, 17:16
Medium 6.4 Cross-Site Scripting (XSS) in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) (CVE-2025-13368). Risk of unauthorized operations or information disclosure. CVE-2025-13368 Apr 4, 17:16