Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

High 8.1 Cross-Site Scripting (XSS) in Autodesk Fusion desktop application Cross-site scripting in Autodesk Fusion desktop application (CVE-2026-0534). Confidential information can be exposed externally. CVE-2026-0534 Jan 23, 02:16
High 8.1 Cross-Site Scripting (XSS) in Autodesk Fusion desktop application Cross-site scripting in Autodesk Fusion desktop application (CVE-2026-0533). Confidential information can be exposed externally. CVE-2026-0533 Jan 23, 02:16
Medium 6.5 Cross-Site Scripting (XSS) in Enfold Cross-site scripting in Enfold (CVE-2025-68900). Risk of unauthorized operations or information disclosure. CVE-2025-68900 Jan 23, 02:16
Medium 5.5 Cross-Site Scripting (XSS) in Hotel Guest Hotspot Cross-site scripting in Hotel Guest Hotspot (CVE-2025-4763). Risk of unauthorized operations or information disclosure. CVE-2025-4763 Jan 22, 19:16
Medium 5.4 Cross-Site Scripting (XSS) in argo-workflows Cross-site scripting in argo-workflows (CVE-2026-23960). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.6.17, 3.7.8 or later. CVE-2026-23960 Jan 22, 07:15
Medium 5.4 Cross-Site Scripting (XSS) in GetSimple CMS My SMTP Contact Plugin Cross-site scripting in GetSimple CMS My SMTP Contact Plugin (CVE-2021-47870). Risk of unauthorized operations or information disclosure. CVE-2021-47870 Jan 22, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in OpenEMR Cross-site scripting in OpenEMR (CVE-2021-47817). Risk of unauthorized operations or information disclosure. CVE-2021-47817 Jan 22, 03:16
Medium 6.1 Cross-Site Scripting (XSS) in hexpm Cross-site scripting in hexpm (CVE-2026-21618). Risk of unauthorized operations or information disclosure. CVE-2026-21618 Jan 20, 00:15
High 7.2 Cross-Site Scripting (XSS) in Marky Cross-site scripting in Marky (CVE-2021-47839). Risk of unauthorized operations or information disclosure. CVE-2021-47839 Jan 17, 06:30
Medium 6.1 Cross-Site Scripting (XSS) in Markdown Explorer Cross-site scripting in Markdown Explorer (CVE-2021-47836). Risk of unauthorized operations or information disclosure. CVE-2021-47836 Jan 17, 04:16
Medium 5.4 Cross-Site Scripting (XSS) in Typesetter CMS Cross-site scripting in Typesetter CMS (CVE-2025-71164). Risk of unauthorized operations or information disclosure. CVE-2025-71164 Jan 15, 04:16
Medium 5.4 Cross-Site Scripting (XSS) in Typesetter CMS Cross-site scripting in Typesetter CMS (CVE-2025-71165). Risk of unauthorized operations or information disclosure. CVE-2025-71165 Jan 15, 04:16
Medium 5.4 Cross-Site Scripting (XSS) in Typesetter CMS Cross-site scripting in Typesetter CMS (CVE-2025-71166). Risk of unauthorized operations or information disclosure. CVE-2025-71166 Jan 15, 04:16
Medium 6.1 Cross-Site Scripting (XSS) in @angular/compiler Cross-site scripting in @angular/compiler (CVE-2026-22610). Risk of unauthorized operations or information disclosure. Exploitable via href. CVE-2026-22610 Jan 10, 13:16
High 8.0 Cross-Site Scripting (XSS) in Shopify Cross-site scripting in Shopify (CVE-2026-22029). Confidential information can be exposed externally. CVE-2026-22029 Jan 10, 12:15
High 7.6 Cross-Site Scripting (XSS) in react-router Cross-site scripting in react-router (CVE-2025-59057). Confidential information can be exposed externally. Exploitable via createBrowserRouter. Mitigation: upgrade to 7.9.0 or later. CVE-2025-59057 Jan 10, 12:15
High 8.2 Cross-Site Scripting (XSS) in react-router Cross-site scripting in react-router (CVE-2026-21884). Confidential information can be exposed externally. Exploitable via getKey. Mitigation: upgrade to 7.12.0 or later. CVE-2026-21884 Jan 10, 12:15
High 8.7 Cross-Site Scripting (XSS) in gitlab Cross-site scripting in gitlab (CVE-2025-9222). Confidential information can be exposed externally. Mitigation: upgrade to 18.5.5, 18.6.3, 18.7.1 or later. CVE-2025-9222 Jan 9, 21:32
High 8.0 Cross-Site Scripting (XSS) in gitlab Cross-site scripting in gitlab (CVE-2025-13761). Confidential information can be exposed externally. Mitigation: upgrade to 18.6.3, 18.7.1 or later. CVE-2025-13761 Jan 9, 21:32
High 7.1 Cross-Site Scripting (XSS) in Pinpoll Cross-site scripting in Pinpoll (CVE-2025-68889). Risk of unauthorized operations or information disclosure. CVE-2025-68889 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in WP App Bar Cross-site scripting in WP App Bar (CVE-2025-68891). Risk of unauthorized operations or information disclosure. CVE-2025-68891 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in e-shops Cross-site scripting in e-shops (CVE-2025-68890). Risk of unauthorized operations or information disclosure. CVE-2025-68890 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Scroll rss excerpt Cross-site scripting in Scroll rss excerpt (CVE-2025-68892). Risk of unauthorized operations or information disclosure. CVE-2025-68892 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in PRIMER by chloédigital Cross-site scripting in PRIMER by chloédigital (CVE-2025-68873). Risk of unauthorized operations or information disclosure. CVE-2025-68873 Jan 8, 19:15
Medium 6.5 Cross-Site Scripting (XSS) in Effect Maker Cross-site scripting in Effect Maker (CVE-2025-68867). Risk of unauthorized operations or information disclosure. CVE-2025-68867 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in WordPress WP-BusinessDirectory Cross-site scripting in WordPress WP-BusinessDirectory (CVE-2025-68887). Risk of unauthorized operations or information disclosure. CVE-2025-68887 Jan 8, 19:15
Medium 6.5 Cross-Site Scripting (XSS) in Flaming Password Reset Cross-site scripting in Flaming Password Reset (CVE-2025-68875). Risk of unauthorized operations or information disclosure. CVE-2025-68875 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Visitor Stats Widget Cross-site scripting in Visitor Stats Widget (CVE-2025-68874). Risk of unauthorized operations or information disclosure. CVE-2025-68874 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Listeo Core Cross-site scripting in Listeo Core (CVE-2025-67932). Risk of unauthorized operations or information disclosure. CVE-2025-67932 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Taskbuilder Cross-site scripting in Taskbuilder (CVE-2025-67933). Risk of unauthorized operations or information disclosure. CVE-2025-67933 Jan 8, 19:15