slug: cwe-79
Explanation
CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。
結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。
対策はWebの基本中の基本: 出力時のHTMLエスケープです。
Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
Related links
Related tags
Vulnerabilities tagged with this 9,250
- High 7.1 Cross-Site Scripting (XSS) in WPCHURCH Cross-site scripting in WPCHURCH (CVE-2025-31642). Risk of unauthorized operations or information disclosure. CVE-2025-31642
- High 7.1 Cross-Site Scripting (XSS) in Woocommerce Sales Funnel Builder Cross-site scripting in Woocommerce Sales Funnel Builder (CVE-2025-30631). Risk of unauthorized operations or information disclosure. CVE-2025-30631
- Medium 5.9 Cross-Site Scripting (XSS) in UiChemy Cross-site scripting in UiChemy (CVE-2025-69362). Risk of unauthorized operations or information disclosure. CVE-2025-69362
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69360). Risk of unauthorized operations or information disclosure. CVE-2025-69360
- Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69357). Risk of unauthorized operations or information disclosure. CVE-2025-69357
- Medium 5.9 Cross-Site Scripting (XSS) in Accordion Cross-site scripting in Accordion (CVE-2025-69350). Risk of unauthorized operations or information disclosure. CVE-2025-69350
- Medium 6.5 Cross-Site Scripting (XSS) in Wishlist for WooCommerce Cross-site scripting in Wishlist for WooCommerce (CVE-2025-69334). Risk of unauthorized operations or information disclosure. CVE-2025-69334
- Medium 6.5 Cross-Site Scripting (XSS) in Team Showcase Cross-site scripting in Team Showcase (CVE-2025-69335). Risk of unauthorized operations or information disclosure. CVE-2025-69335
- High 7.1 Cross-Site Scripting (XSS) in JobBank Cross-site scripting in JobBank (CVE-2025-69085). Risk of unauthorized operations or information disclosure. CVE-2025-69085
- High 7.1 Cross-Site Scripting (XSS) in Photo Gallery Cross-site scripting in Photo Gallery (CVE-2025-69084). Risk of unauthorized operations or information disclosure. CVE-2025-69084
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla Cross-site scripting in Joomla (CVE-2025-63082). Risk of unauthorized operations or information disclosure. CVE-2025-63082
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla Cross-site scripting in Joomla (CVE-2025-63083). Risk of unauthorized operations or information disclosure. CVE-2025-63083
- Medium 6.4 Cross-Site Scripting (XSS) in Phlox (WordPress theme) Cross-site scripting in Phlox (WordPress theme) (CVE-2025-4776). Risk of unauthorized operations or information disclosure. CVE-2025-4776
- High 7.2 Cross-Site Scripting (XSS) in vega-functions Cross-site scripting in vega-functions (CVE-2025-66648). Risk of unauthorized operations or information disclosure. Exploitable via vega.expressionInterpreter. Mitigation: upgrade to 6.1.1 or later. CVE-2025-66648
- High 8.1 Cross-Site Scripting (XSS) in Vega Cross-site scripting in Vega (CVE-2025-65110). Confidential information can be exposed externally. Exploitable via vega. CVE-2025-65110
- High 8.0 Vulnerability in Coollabs CVE-2025-59158
- High 8.8 Code Injection in muffon CVE-2025-55204
- Medium 5.4 Cross-Site Scripting (XSS) in Heytap Cross-site scripting in Heytap (CVE-2025-67316). Risk of unauthorized operations or information disclosure. CVE-2025-67316
- High 7.5 Cross-Site Scripting (XSS) in UCRM Argentina AFIP invoices Plugin Cross-site scripting in UCRM Argentina AFIP invoices Plugin (CVE-2025-59467). Successful exploitation can lead to full system takeover. CVE-2025-59467
- Medium 6.5 Cross-Site Scripting (XSS) in Dokan Pro Cross-site scripting in Dokan Pro (CVE-2025-39497). Risk of unauthorized operations or information disclosure. CVE-2025-39497
- Unrated Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting… Cross-site scripting reported (CVE-2025-15022). Risk of unauthorized operations or information disclosure. CVE-2025-15022
- Low 2.4 Cross-Site Scripting (XSS) in xnx3 wangmarket Cross-site scripting in xnx3 wangmarket (CVE-2025-15452). Risk of unauthorized operations or information disclosure. CVE-2025-15452
- Low 3.1 Cross-Site Scripting (XSS) in zhanglun lettura Cross-site scripting in zhanglun lettura (CVE-2025-15454). Risk of unauthorized operations or information disclosure. CVE-2025-15454
- Low 2.4 Cross-Site Scripting (XSS) in xnx3 wangmarket Cross-site scripting in xnx3 wangmarket (CVE-2025-15451). Risk of unauthorized operations or information disclosure. CVE-2025-15451
- Medium 5.4 Cross-Site Scripting (XSS) in Kentico Xperience Cross-site scripting in Kentico Xperience (CVE-2025-5591). Risk of unauthorized operations or information disclosure. CVE-2025-5591
- Medium 4.9 Cross-Site Scripting (XSS) in Artifactory Cross-site scripting in Artifactory (CVE-2025-14830). Confidential information can be exposed externally. CVE-2025-14830
- Medium 6.1 Cross-Site Scripting (XSS) in QuMagie Cross-site scripting in QuMagie (CVE-2025-62857). Risk of unauthorized operations or information disclosure. CVE-2025-62857
- Low 3.5 Cross-Site Scripting (XSS) in LigeroSmart Cross-site scripting in LigeroSmart (CVE-2025-15437). Risk of unauthorized operations or information disclosure. CVE-2025-15437
- Low 2.4 Cross-Site Scripting (XSS) in xnx3 wangmarket Cross-site scripting in xnx3 wangmarket (CVE-2025-15416). Risk of unauthorized operations or information disclosure. CVE-2025-15416
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67710). Risk of unauthorized operations or information disclosure. CVE-2025-67710