slug: cwe-79
Explanation
CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。
結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。
対策はWebの基本中の基本: 出力時のHTMLエスケープです。
Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
Related links
Related tags
Vulnerabilities tagged with this 9,207
- Medium 6.1 Cross-Site Scripting (XSS) in SVXportal Cross-site scripting in SVXportal (CVE-2026-27502). Risk of unauthorized operations or information disclosure. CVE-2026-27502
- Medium 6.1 Cross-Site Scripting (XSS) in SVXportal Cross-site scripting in SVXportal (CVE-2026-27503). Risk of unauthorized operations or information disclosure. CVE-2026-27503
- Exploited High Cross-Site Scripting (XSS) in Roundcube Webmail Cross-site scripting in Roundcube Webmail (CVE-2025-68461). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. CVE-2025-68461
- Medium 6.3 Cross-Site Scripting (XSS) in INFOREX- General Information Management System Cross-site scripting in INFOREX- General Information Management System (CVE-2025-8308). Risk of unauthorized operations or information disclosure. CVE-2025-8308
- Medium 6.5 Cross-Site Scripting (XSS) in Real Estate Script Cross-site scripting in Real Estate Script (CVE-2025-8303). Risk of unauthorized operations or information disclosure. CVE-2025-8303
- Unrated Cross-Site Scripting (XSS) in beautiful-mermaid Cross-site scripting in beautiful-mermaid (CVE-2026-26226). Risk of unauthorized operations or information disclosure. CVE-2026-26226
- High 8.2 Cross-Site Scripting (XSS) in E-Commerce Package Cross-site scripting in E-Commerce Package (CVE-2025-13002). Risk of unauthorized operations or information disclosure. CVE-2025-13002
- Medium 6.1 Cross-Site Scripting (XSS) in MiniGal Nano Cross-site scripting in MiniGal Nano (CVE-2026-25868). Risk of unauthorized operations or information disclosure. CVE-2026-25868
- Medium 6.4 Cross-Site Scripting (XSS) in Kimai Cross-site scripting in Kimai (CVE-2019-25317). Risk of unauthorized operations or information disclosure. CVE-2019-25317
- Medium 6.4 Cross-Site Scripting (XSS) in Phraseanet Cross-site scripting in Phraseanet (CVE-2018-25157). Risk of unauthorized operations or information disclosure. CVE-2018-25157
- Critical 9.4 Cross-Site Scripting (XSS) in Turboard Cross-site scripting in Turboard (CVE-2025-8668). Data can be tampered with by attackers. CVE-2025-8668
- High 8.3 Cross-Site Scripting (XSS) in TemizlikYolda Cross-site scripting in TemizlikYolda (CVE-2025-10913). Data can be tampered with by attackers. CVE-2025-10913
- High 8.6 Cross-Site Scripting (XSS) in e-Taxpayer Accounting Website Cross-site scripting in e-Taxpayer Accounting Website (CVE-2025-7799). Data can be tampered with by attackers. CVE-2025-7799
- Medium 6.4 Cross-Site Scripting (XSS) in Bold Page Builder (WordPress plugin) Cross-site scripting in Bold Page Builder (WordPress plugin) (CVE-2025-15267). Risk of unauthorized operations or information disclosure. CVE-2025-15267
- High 7.1 Path Traversal in pydantic-ai CVE-2026-25640
- Medium 4.8 Vulnerability in Cisco Prime Infrastructure CVE-2026-20111
- Medium 6.1 Cross-Site Scripting (XSS) in PPC (Belden) ONT 2K05X router running firmware Cross-site scripting in PPC (Belden) ONT 2K05X router running firmware (CVE-2025-70545). Risk of unauthorized operations or information disclosure. CVE-2025-70545
- High 8.8 Cross-Site Scripting (XSS) in ViPort Cross-site scripting in ViPort (CVE-2026-1819). Successful exploitation can lead to full system takeover. CVE-2026-1819
- Medium 5.4 Cross-Site Scripting (XSS) in Netbox Cross-site scripting in Netbox (CVE-2025-69848). Risk of unauthorized operations or information disclosure. CVE-2025-69848
- High 8.6 Cross-Site Scripting (XSS) in Website Software Cross-site scripting in Website Software (CVE-2025-6397). Risk of unauthorized operations or information disclosure. CVE-2025-6397
- High 7.6 Cross-Site Scripting (XSS) in Association Web Package Flora Cross-site scripting in Association Web Package Flora (CVE-2025-7760). Risk of unauthorized operations or information disclosure. CVE-2025-7760
- High 7.6 Cross-Site Scripting (XSS) in Kod8 Individual and SME Website Cross-site scripting in Kod8 Individual and SME Website (CVE-2025-8456). Risk of unauthorized operations or information disclosure. CVE-2025-8456
- High 7.6 Cross-Site Scripting (XSS) in syWEB Cross-site scripting in syWEB (CVE-2025-8461). Risk of unauthorized operations or information disclosure. CVE-2025-8461
- High 7.6 Cross-Site Scripting (XSS) in SKSPro Cross-site scripting in SKSPro (CVE-2025-8589). Risk of unauthorized operations or information disclosure. CVE-2025-8589
- Medium 4.8 Cross-Site Scripting (XSS) in FluentCMS Cross-site scripting in FluentCMS (CVE-2025-15549). Risk of unauthorized operations or information disclosure. CVE-2025-15549
- High 7.5 Cross-Site Scripting (XSS) in Content Management System Cross-site scripting in Content Management System (CVE-2025-7713). Risk of unauthorized operations or information disclosure. CVE-2025-7713
- Medium 6.4 Cross-Site Scripting (XSS) in GOautodial Cross-site scripting in GOautodial (CVE-2020-37018). Risk of unauthorized operations or information disclosure. CVE-2020-37018
- Medium 5.4 Cross-Site Scripting (XSS) in LavaLite CMS Cross-site scripting in LavaLite CMS (CVE-2025-71177). Risk of unauthorized operations or information disclosure. CVE-2025-71177
- Medium 4.7 Cross-Site Scripting (XSS) in Tap&Sign Cross-site scripting in Tap&Sign (CVE-2025-2204). Risk of unauthorized operations or information disclosure. CVE-2025-2204
- High 8.1 Cross-Site Scripting (XSS) in Autodesk Fusion desktop application Cross-site scripting in Autodesk Fusion desktop application (CVE-2026-0535). Confidential information can be exposed externally. CVE-2026-0535