Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

Medium 6.4 Cross-Site Scripting (XSS) in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) Cross-site scripting in Xpro Addons — 140+ Widgets for Elementor (WordPress plugin) (CVE-2026-2949). Risk of unauthorized operations or information disclosure. CVE-2026-2949 Apr 4, 13:17
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-2924). Risk of unauthorized operations or information disclosure. CVE-2026-2924 Apr 4, 13:17
Medium 6.1 Cross-Site Scripting (XSS) in Emlog Cross-site scripting in Emlog (CVE-2026-34229). Risk of unauthorized operations or information disclosure. CVE-2026-34229 Apr 4, 08:17
Low 3.5 Cross-Site Scripting (XSS) in github.com/casdoor/casdoor Cross-site scripting in github.com/casdoor/casdoor (CVE-2026-5468). Risk of unauthorized operations or information disclosure. CVE-2026-5468 Apr 3, 23:16
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-27655). Confidential information can be exposed externally. CVE-2026-27655 Apr 3, 22:17
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-4107). Confidential information can be exposed externally. CVE-2026-4107 Apr 3, 21:16
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-4108). Confidential information can be exposed externally. CVE-2026-4108 Apr 3, 21:16
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-3879). Confidential information can be exposed externally. CVE-2026-3879 Apr 3, 21:16
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-3880). Confidential information can be exposed externally. CVE-2026-3880 Apr 3, 21:16
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-28703). Confidential information can be exposed externally. CVE-2026-28703 Apr 3, 21:16
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-28754). Confidential information can be exposed externally. CVE-2026-28754 Apr 3, 20:17
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2026-28756). Confidential information can be exposed externally. CVE-2026-28756 Apr 3, 20:17
Medium 6.1 Cross-Site Scripting (XSS) in Roundcube Webmail Cross-site scripting in Roundcube Webmail (CVE-2026-35539). Risk of unauthorized operations or information disclosure. CVE-2026-35539 Apr 3, 14:16
Medium 6.1 Cross-Site Scripting (XSS) in dompurify Cross-site scripting in dompurify (CVE-2026-65912). Risk of unauthorized operations or information disclosure. Exploitable via ADD_ATTR. Mitigation: upgrade to 3.3.2 or later. CVE-2026-65912 Apr 3, 12:46
Medium 5.4 Cross-Site Scripting (XSS) in Shynet Cross-site scripting in Shynet (CVE-2026-35508). Risk of unauthorized operations or information disclosure. CVE-2026-35508 Apr 3, 11:16
Medium 6.1 Cross-Site Scripting (XSS) in telejson Cross-site scripting in telejson (CVE-2026-47099). Risk of unauthorized operations or information disclosure. Exploitable via postMessage. Mitigation: upgrade to 6.0.0 or later. CVE-2026-47099 Apr 3, 08:21
Medium 6.1 Cross-Site Scripting (XSS) in Cmu Cross-site scripting in Cmu (CVE-2026-35466). Risk of unauthorized operations or information disclosure. CVE-2026-35466 Apr 3, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Interzen Consulting S.r.l ZenShare Suite Cross-site scripting in Interzen Consulting S.r.l ZenShare Suite (CVE-2026-30251). Risk of unauthorized operations or information disclosure. CVE-2026-30251 Apr 3, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Interzen Consulting S.r.l ZenShare Suite Cross-site scripting in Interzen Consulting S.r.l ZenShare Suite (CVE-2026-30252). Risk of unauthorized operations or information disclosure. CVE-2026-30252 Apr 3, 06:16
Medium 5.4 Cross-Site Scripting (XSS) in hoppscotch Cross-site scripting in hoppscotch (CVE-2026-34848). Risk of unauthorized operations or information disclosure. CVE-2026-34848 Apr 3, 05:16
Critical 9.3 Cross-Site Scripting (XSS) in hoppscotch Cross-site scripting in hoppscotch (CVE-2026-34932). Confidential information can be exposed externally. CVE-2026-34932 Apr 3, 05:16
Low 3.5 Cross-Site Scripting (XSS) in krayin laravel-crm Cross-site scripting in krayin laravel-crm (CVE-2026-5370). Risk of unauthorized operations or information disclosure. CVE-2026-5370 Apr 3, 03:16
High 8.2 Cross-Site Scripting (XSS) in DbGate Cross-site scripting in DbGate (CVE-2026-34725). Successful exploitation can lead to full system takeover. CVE-2026-34725 Apr 3, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2026-34606). Risk of unauthorized operations or information disclosure. CVE-2026-34606 Apr 3, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in YesWiki Cross-site scripting in YesWiki (CVE-2026-34598). Risk of unauthorized operations or information disclosure. CVE-2026-34598 Apr 3, 03:16
Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34821). Risk of unauthorized operations or information disclosure. CVE-2026-34821 Apr 3, 00:16
Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34822). Risk of unauthorized operations or information disclosure. CVE-2026-34822 Apr 3, 00:16
Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34823). Risk of unauthorized operations or information disclosure. CVE-2026-34823 Apr 3, 00:16
Medium 5.4 Cross-Site Scripting (XSS) in phpMyFAQ Cross-site scripting in phpMyFAQ (CVE-2026-34974). Risk of unauthorized operations or information disclosure. CVE-2026-34974 Apr 3, 00:16
Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34816). Risk of unauthorized operations or information disclosure. CVE-2026-34816 Apr 3, 00:16