Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

Medium 6.4 Cross-Site Scripting (XSS) in King Addons for Elementor (WordPress plugin) Cross-site scripting in King Addons for Elementor (WordPress plugin) (CVE-2025-13535). Risk of unauthorized operations or information disclosure. CVE-2025-13535 Apr 2, 00:16
Critical 9.0 Cross-Site Scripting (XSS) in github.com/siyuan-note/siyuan/kernel Cross-site scripting in github.com/siyuan-note/siyuan/kernel (CVE-2026-34448). Successful exploitation can lead to full system takeover. Exploitable via mAsse. Mitigation: upgrade to 3.6.2 or later. CVE-2026-34448 Apr 1, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in Og Image Cross-site scripting in Og Image (CVE-2026-34405). Risk of unauthorized operations or information disclosure. CVE-2026-34405 Apr 1, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in WWBN AVideo Cross-site scripting in WWBN AVideo (CVE-2026-34739). Risk of unauthorized operations or information disclosure. CVE-2026-34739 Apr 1, 06:16
Medium 4.8 Cross-Site Scripting (XSS) in Sonicwall Email Security Cross-site scripting in Sonicwall Email Security (CVE-2026-3468). Risk of unauthorized operations or information disclosure. CVE-2026-3468 Apr 1, 06:16
Medium 6.4 Cross-Site Scripting (XSS) in WWBN AVideo Cross-site scripting in WWBN AVideo (CVE-2026-34716). Risk of unauthorized operations or information disclosure. CVE-2026-34716 Apr 1, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in WWBN AVideo Cross-site scripting in WWBN AVideo (CVE-2026-34396). Risk of unauthorized operations or information disclosure. CVE-2026-34396 Apr 1, 06:16
Medium 6.1 Cross-Site Scripting (XSS) in Captcha Protect Cross-site scripting in Captcha Protect (CVE-2026-34206). Risk of unauthorized operations or information disclosure. CVE-2026-34206 Apr 1, 05:16
Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Leave Application System Cross-site scripting in SourceCodester Leave Application System (CVE-2026-5209). Risk of unauthorized operations or information disclosure. CVE-2026-5209 Apr 1, 04:16
Medium 5.4 Cross-Site Scripting (XSS) in Discourse Cross-site scripting in Discourse (CVE-2026-32607). Risk of unauthorized operations or information disclosure. CVE-2026-32607 Apr 1, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in Discourse Cross-site scripting in Discourse (CVE-2026-32243). Risk of unauthorized operations or information disclosure. CVE-2026-32243 Apr 1, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in Discourse Cross-site scripting in Discourse (CVE-2026-32273). Risk of unauthorized operations or information disclosure. CVE-2026-32273 Apr 1, 03:16
Low 3.4 Cross-Site Scripting (XSS) in Pega Platform Cross-site scripting in Pega Platform (CVE-2025-62184). Risk of unauthorized operations or information disclosure. CVE-2025-62184 Apr 1, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in slippers Cross-site scripting in slippers (CVE-2026-34231). Risk of unauthorized operations or information disclosure. Exploitable via slippers. Mitigation: upgrade to 0.6.3 or later. CVE-2026-34231 Apr 1, 01:16
Medium 5.4 Cross-Site Scripting (XSS) in Checkmk Cross-site scripting in Checkmk (CVE-2026-33276). Risk of unauthorized operations or information disclosure. CVE-2026-33276 Apr 1, 00:16
Medium 5.4 Cross-Site Scripting (XSS) in Checkmk Cross-site scripting in Checkmk (CVE-2026-20915). Risk of unauthorized operations or information disclosure. CVE-2026-20915 Apr 1, 00:16
High 7.2 Cross-Site Scripting (XSS) in Query Monitor – The developer tools panel for (WordPress plugin) Cross-site scripting in Query Monitor – The developer tools panel for (WordPress plugin) (CVE-2026-4267). Risk of unauthorized operations or information disclosure. CVE-2026-4267 Mar 31, 21:16
Medium 6.1 Cross-Site Scripting (XSS) in IngEstate Server Cross-site scripting in IngEstate Server (CVE-2026-30082). Risk of unauthorized operations or information disclosure. CVE-2026-30082 Mar 31, 00:16
Unrated Cross-Site Scripting (XSS) in trix Cross-site scripting in trix (CVE-2026-73427). Risk of unauthorized operations or information disclosure. Exploitable via StringPiece.fromJSON. Mitigation: upgrade to 2.1.18 or later. CVE-2026-73427 Mar 30, 00:22
High 8.2 Cross-Site Scripting (XSS) in Handlebarsjs Cross-site scripting in Handlebarsjs (CVE-2026-33941). Successful exploitation can lead to full system takeover. CVE-2026-33941 Mar 28, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in dompurify Cross-site scripting in dompurify (CVE-2026-65914). Risk of unauthorized operations or information disclosure. Exploitable via POST /sanitize. Mitigation: upgrade to 3.3.2 or later. CVE-2026-65914 Mar 28, 05:41
Medium 6.1 Cross-Site Scripting (XSS) in Ahsanriaz26Gmailcom Cross-site scripting in Ahsanriaz26Gmailcom (CVE-2026-30567). Risk of unauthorized operations or information disclosure. CVE-2026-30567 Mar 28, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in n8n Cross-site scripting in n8n (CVE-2026-56358). Risk of unauthorized operations or information disclosure. Exploitable via NODES_EXCLUDE. Mitigation: upgrade to 1.123.25 or later. CVE-2026-56358 Mar 28, 03:05
Unrated A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an… Cross-site scripting reported (CVE-2026-5010). Risk of unauthorized operations or information disclosure. CVE-2026-5010 Mar 28, 00:17
Medium 6.1 Vulnerability in github.com/openbao/openbao CVE-2026-33758 Mar 28, 00:16
Medium 6.1 Cross-Site Scripting (XSS) in Lyrasis Cross-site scripting in Lyrasis (CVE-2025-61190). Risk of unauthorized operations or information disclosure. CVE-2025-61190 Mar 28, 00:16
Medium 5.4 Cross-Site Scripting (XSS) in ByteDance DeerFlow Cross-site scripting in ByteDance DeerFlow (CVE-2026-32859). Risk of unauthorized operations or information disclosure. CVE-2026-32859 Mar 27, 23:16
Medium 6.8 Cross-Site Scripting (XSS) in Sentinel LDK Runtime Cross-site scripting in Sentinel LDK Runtime (CVE-2026-3457). Data can be tampered with by attackers. CVE-2026-3457 Mar 27, 18:31
Medium 5.4 Cross-Site Scripting (XSS) in MiKa OpenStreetMap Cross-site scripting in MiKa OpenStreetMap (CVE-2026-33559). Risk of unauthorized operations or information disclosure. CVE-2026-33559 Mar 27, 15:16
Medium 5.4 Cross-Site Scripting (XSS) in Stirling-PDF Cross-site scripting in Stirling-PDF (CVE-2026-34071). Risk of unauthorized operations or information disclosure. CVE-2026-34071 Mar 27, 02:16