Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27232). Risk of unauthorized operations or information disclosure. CVE-2026-27232 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27231). Risk of unauthorized operations or information disclosure. CVE-2026-27231 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27230). Risk of unauthorized operations or information disclosure. CVE-2026-27230 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27226). Risk of unauthorized operations or information disclosure. CVE-2026-27226 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27225). Risk of unauthorized operations or information disclosure. CVE-2026-27225 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27224). Risk of unauthorized operations or information disclosure. CVE-2026-27224 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27223). Risk of unauthorized operations or information disclosure. CVE-2026-27223 Mar 11, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Schneider Electric Modicon M258 Firmware Cross-site scripting in Schneider Electric Modicon M258 Firmware (CVE-2025-13902). Risk of unauthorized operations or information disclosure. CVE-2025-13902 Mar 11, 03:17
Medium 5.4 Cross-Site Scripting (XSS) in Ymfe Cross-site scripting in Ymfe (CVE-2025-70060). Risk of unauthorized operations or information disclosure. CVE-2025-70060 Mar 10, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in Sbitsoft Cross-site scripting in Sbitsoft (CVE-2025-40638). Risk of unauthorized operations or information disclosure. CVE-2025-40638 Mar 9, 19:16
Medium 6.1 Cross-Site Scripting (XSS) in Humhub Cross-site scripting in Humhub (CVE-2026-29052). Risk of unauthorized operations or information disclosure. CVE-2026-29052 Mar 5, 15:16
Medium 6.1 Cross-Site Scripting (XSS) in Cisco Secure Firewall ASA Software Cross-site scripting in Cisco Secure Firewall ASA Software (CVE-2026-20102). Risk of unauthorized operations or information disclosure. CVE-2026-20102 Mar 5, 03:16
Critical 9.0 Vulnerability in org.xwiki.contrib.blog:application-blog-ui CVE-2025-66024 Mar 5, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in DOMPurify Cross-site scripting in DOMPurify (CVE-2025-15599). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.2.7 or later. CVE-2025-15599 Mar 4, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in Fireware OS Web UI enabled execution Cross-site scripting in Fireware OS Web UI enabled execution (CVE-2026-3343). Risk of unauthorized operations or information disclosure. CVE-2026-3343 Mar 3, 23:15
Medium 6.3 Cross-Site Scripting (XSS) in EduAsist Cross-site scripting in EduAsist (CVE-2025-11950). Risk of unauthorized operations or information disclosure. CVE-2025-11950 Feb 27, 22:16
Medium 5.4 Cross-Site Scripting (XSS) in PluXml CMS Cross-site scripting in PluXml CMS (CVE-2026-24351). Risk of unauthorized operations or information disclosure. CVE-2026-24351 Feb 27, 21:16
Medium 5.4 Cross-Site Scripting (XSS) in PluXml CMS Cross-site scripting in PluXml CMS (CVE-2026-24350). Risk of unauthorized operations or information disclosure. CVE-2026-24350 Feb 27, 21:16
High 7.6 Cross-Site Scripting (XSS) in E-Commerce Product Cross-site scripting in E-Commerce Product (CVE-2025-14343). Risk of unauthorized operations or information disclosure. CVE-2025-14343 Feb 26, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in Arcinfo Cross-site scripting in Arcinfo (CVE-2026-1695). Risk of unauthorized operations or information disclosure. CVE-2026-1695 Feb 26, 17:16
Medium 6.1 Cross-Site Scripting (XSS) in Arcinfo Cross-site scripting in Arcinfo (CVE-2026-1696). Risk of unauthorized operations or information disclosure. CVE-2026-1696 Feb 26, 17:16
Medium 6.1 Cross-Site Scripting (XSS) in Angular Cross-site scripting in Angular (CVE-2026-27970). Risk of unauthorized operations or information disclosure. CVE-2026-27970 Feb 26, 11:16
Critical 9.6 Vulnerability in Storybook CVE-2026-27148 Feb 26, 07:16
Medium 4.8 Cross-Site Scripting (XSS) in GetSimpleCMS Community Edition Cross-site scripting in GetSimpleCMS Community Edition (CVE-2026-26351). Risk of unauthorized operations or information disclosure. CVE-2026-26351 Feb 25, 08:16
Medium 5.4 Cross-Site Scripting (XSS) in Bludit Cross-site scripting in Bludit (CVE-2026-27742). Risk of unauthorized operations or information disclosure. CVE-2026-27742 Feb 24, 07:16
Critical 9.3 Vulnerability in Naturalintelligence CVE-2026-25896 Feb 21, 06:19
High 8.1 Cross-Site Scripting (XSS) in google-cloud-aiplatform Cross-site scripting in google-cloud-aiplatform (CVE-2026-2472). Confidential information can be exposed externally. Mitigation: upgrade to 1.131.0 or later. CVE-2026-2472 Feb 21, 05:25
Medium 6.1 Cross-Site Scripting (XSS) in SVXportal Cross-site scripting in SVXportal (CVE-2026-27504). Risk of unauthorized operations or information disclosure. CVE-2026-27504 Feb 21, 02:25
Medium 6.1 Cross-Site Scripting (XSS) in SVXportal Cross-site scripting in SVXportal (CVE-2026-27505). Risk of unauthorized operations or information disclosure. CVE-2026-27505 Feb 21, 02:25
Medium 6.1 Cross-Site Scripting (XSS) in SVXportal Cross-site scripting in SVXportal (CVE-2026-27506). Risk of unauthorized operations or information disclosure. CVE-2026-27506 Feb 21, 02:25