Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

Medium 6.1 Cross-Site Scripting (XSS) in Lightcms Cross-site scripting in Lightcms (CVE-2026-29934). Risk of unauthorized operations or information disclosure. CVE-2026-29934 Mar 27, 00:16
Medium 4.8 Cross-Site Scripting (XSS) in Domoticz Cross-site scripting in Domoticz (CVE-2026-1001). Risk of unauthorized operations or information disclosure. CVE-2026-1001 Mar 26, 04:16
High 8.7 Cross-Site Scripting (XSS) in Seafile Cross-site scripting in Seafile (CVE-2026-30587). Confidential information can be exposed externally. Mitigation: upgrade to 13.0.17 or later. CVE-2026-30587 Mar 26, 03:16
Medium 6.5 Cross-Site Scripting (XSS) in Grid Cross-site scripting in Grid (CVE-2026-24370). Risk of unauthorized operations or information disclosure. CVE-2026-24370 Mar 26, 02:16
High 8.2 Cross-Site Scripting (XSS) in Hitachi Infrastructure Analytics Advisor Cross-site scripting in Hitachi Infrastructure Analytics Advisor (CVE-2026-2072). Confidential information can be exposed externally. CVE-2026-2072 Mar 25, 12:16
Medium 4.3 Cross-Site Scripting (XSS) in Apple Ipados Cross-site scripting in Apple Ipados (CVE-2026-28861). Risk of unauthorized operations or information disclosure. CVE-2026-28861 Mar 25, 10:17
High 8.2 Cross-Site Scripting (XSS) in oRPC Cross-site scripting in oRPC (CVE-2026-33331). Confidential information can be exposed externally. CVE-2026-33331 Mar 25, 05:16
Medium 6.1 Cross-Site Scripting (XSS) in actionpack Cross-site scripting in actionpack (CVE-2026-33167). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 8.1.2.1 or later. CVE-2026-33167 Mar 24, 05:45
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2026-32851). Risk of unauthorized operations or information disclosure. CVE-2026-32851 Mar 24, 05:16
Medium 6.1 A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the… Cross-site scripting reported (CVE-2025-52204). Risk of unauthorized operations or information disclosure. CVE-2025-52204 Mar 24, 05:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-0609). Risk of unauthorized operations or information disclosure. CVE-2026-0609 Mar 21, 15:30
Medium 5.4 Cross-Site Scripting (XSS) in SyncFusion Cross-site scripting in SyncFusion (CVE-2025-63260). Risk of unauthorized operations or information disclosure. CVE-2025-63260 Mar 21, 05:16
Medium 4.8 Cross-Site Scripting (XSS) in QuFTP Service Cross-site scripting in QuFTP Service (CVE-2026-22895). Risk of unauthorized operations or information disclosure. CVE-2026-22895 Mar 21, 02:16
Unrated Cross-Site Scripting (XSS) in Location Aware Sensor System by Linkit ONE Cross-site scripting in Location Aware Sensor System by Linkit ONE (CVE-2026-32843). Risk of unauthorized operations or information disclosure. CVE-2026-32843 Mar 20, 00:16
Medium 6.1 Cross-Site Scripting (XSS) in Zucchetti Axess access control devices Cross-site scripting in Zucchetti Axess access control devices (CVE-2026-30695). Risk of unauthorized operations or information disclosure. CVE-2026-30695 Mar 19, 02:16
Critical 9.6 Cross-Site Scripting (XSS) in jsPDF Cross-site scripting in jsPDF (CVE-2026-31938). Confidential information can be exposed externally. Exploitable via options. CVE-2026-31938 Mar 18, 13:17
Exploited High 7.2 Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2025-66376). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. CVE-2025-66376 Mar 18, 09:00
Medium 4.7 Cross-Site Scripting (XSS) in Hcltech Cross-site scripting in Hcltech (CVE-2025-62320). Risk of unauthorized operations or information disclosure. CVE-2025-62320 Mar 17, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in Forcepoint Cross-site scripting in Forcepoint (CVE-2025-2274). Risk of unauthorized operations or information disclosure. CVE-2025-2274 Mar 17, 00:16
High 7.2 Cross-Site Scripting (XSS) in ZKTeco ZKAccess Security System Cross-site scripting in ZKTeco ZKAccess Security System (CVE-2016-20032). Risk of unauthorized operations or information disclosure. CVE-2016-20032 Mar 16, 23:17
Medium 6.1 Cross-Site Scripting (XSS) in ZKTeco ZKBioSecurity Cross-site scripting in ZKTeco ZKBioSecurity (CVE-2016-20027). Risk of unauthorized operations or information disclosure. CVE-2016-20027 Mar 16, 23:17
Medium 6.4 Cross-Site Scripting (XSS) in Vulnogram Cross-site scripting in Vulnogram (CVE-2026-32774). Risk of unauthorized operations or information disclosure. CVE-2026-32774 Mar 15, 06:44
High 7.6 Cross-Site Scripting (XSS) in OneUptime Cross-site scripting in OneUptime (CVE-2026-32308). Confidential information can be exposed externally. Mitigation: upgrade to 10.0.23 or later. CVE-2026-32308 Mar 14, 04:54
Medium 6.1 Cross-Site Scripting (XSS) in IBM Sterling Partner Engagement Manager Cross-site scripting in IBM Sterling Partner Engagement Manager (CVE-2025-13702). Risk of unauthorized operations or information disclosure. CVE-2025-13702 Mar 14, 04:53
Medium 4.6 Cross-Site Scripting (XSS) in action_text-trix Cross-site scripting in action_text-trix (CVE-2026-73426). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.1.17 or later. CVE-2026-73426 Mar 13, 02:29
Medium 6.1 Cross-Site Scripting (XSS) in Progress Flowmon ADS Cross-site scripting in Progress Flowmon ADS (CVE-2026-2513). Risk of unauthorized operations or information disclosure. CVE-2026-2513 Mar 12, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in Progress Flowmon ADS Cross-site scripting in Progress Flowmon ADS (CVE-2026-2514). Risk of unauthorized operations or information disclosure. CVE-2026-2514 Mar 12, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in Cisco Unified Contact Center Express Cross-site scripting in Cisco Unified Contact Center Express (CVE-2026-20117). Risk of unauthorized operations or information disclosure. CVE-2026-20117 Mar 12, 02:16
High 8.1 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21361). Confidential information can be exposed externally. CVE-2026-21361 Mar 11, 12:15
High 8.0 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21311). Confidential information can be exposed externally. CVE-2026-21311 Mar 11, 12:15