Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,208

Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15173). Risk of unauthorized operations or information disclosure. CVE-2025-15173 Dec 29, 2025
Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15172). Risk of unauthorized operations or information disclosure. CVE-2025-15172 Dec 29, 2025
Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15171). Risk of unauthorized operations or information disclosure. CVE-2025-15171 Dec 29, 2025
Medium 4.3 Cross-Site Scripting (XSS) in Advaya Softech GEMS ERP Portal Cross-site scripting in Advaya Softech GEMS ERP Portal (CVE-2025-15170). Risk of unauthorized operations or information disclosure. CVE-2025-15170 Dec 29, 2025
Low 2.4 Cross-Site Scripting (XSS) in rawchen ecms Cross-site scripting in rawchen ecms (CVE-2025-15149). Risk of unauthorized operations or information disclosure. CVE-2025-15149 Dec 29, 2025
Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15146). Risk of unauthorized operations or information disclosure. CVE-2025-15146 Dec 29, 2025
Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15145). Risk of unauthorized operations or information disclosure. CVE-2025-15145 Dec 29, 2025
Medium 4.3 Cross-Site Scripting (XSS) in dayrui XunRuiCMS Cross-site scripting in dayrui XunRuiCMS (CVE-2025-15144). Risk of unauthorized operations or information disclosure. CVE-2025-15144 Dec 29, 2025
Low 3.5 Cross-Site Scripting (XSS) in yourmaileyes MOOC Cross-site scripting in yourmaileyes MOOC (CVE-2025-15134). Risk of unauthorized operations or information disclosure. CVE-2025-15134 Dec 28, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Libredesk Cross-site scripting in Libredesk (CVE-2025-68927). Risk of unauthorized operations or information disclosure. Exploitable via POST /api/v1/contacts/{id}/notes. CVE-2025-68927 Dec 27, 2025
High 7.3 Cross-Site Scripting (XSS) in N8N Cross-site scripting in N8N (CVE-2025-61914). Confidential information can be exposed externally. CVE-2025-61914 Dec 27, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Fluentcms Cross-site scripting in Fluentcms (CVE-2025-67349). Risk of unauthorized operations or information disclosure. CVE-2025-67349 Dec 27, 2025
Medium 5.4 Vulnerability in Hanwhavision CVE-2025-8075 Dec 26, 2025
Medium 5.4 Cross-Site Scripting (XSS) in gitea Cross-site scripting in gitea (CVE-2025-68946). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.20.1 or later. CVE-2025-68946 Dec 26, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Gitea Cross-site scripting in Gitea (CVE-2025-68942). Risk of unauthorized operations or information disclosure. CVE-2025-68942 Dec 26, 2025
Low 3.5 Cross-Site Scripting (XSS) in postmanlabs httpbin Cross-site scripting in postmanlabs httpbin (CVE-2025-15095). Risk of unauthorized operations or information disclosure. CVE-2025-15095 Dec 26, 2025
Medium 4.3 Cross-Site Scripting (XSS) in sunkaifei FlyCMS Cross-site scripting in sunkaifei FlyCMS (CVE-2025-15094). Risk of unauthorized operations or information disclosure. CVE-2025-15094 Dec 26, 2025
Medium 4.3 Cross-Site Scripting (XSS) in sunkaifei FlyCMS Cross-site scripting in sunkaifei FlyCMS (CVE-2025-15093). Risk of unauthorized operations or information disclosure. CVE-2025-15093 Dec 26, 2025
Medium 6.4 Cross-Site Scripting (XSS) in ONLYOFFICE Docs Cross-site scripting in ONLYOFFICE Docs (CVE-2025-68936). Risk of unauthorized operations or information disclosure. CVE-2025-68936 Dec 26, 2025
Medium 6.4 Cross-Site Scripting (XSS) in ONLYOFFICE Docs Cross-site scripting in ONLYOFFICE Docs (CVE-2025-68935). Risk of unauthorized operations or information disclosure. CVE-2025-68935 Dec 26, 2025
High 7.6 Cross-Site Scripting (XSS) in Aidango Cross-site scripting in Aidango (CVE-2025-2307). Data can be tampered with by attackers. CVE-2025-2307 Dec 25, 2025
High 7.6 Cross-Site Scripting (XSS) in Titarus Cross-site scripting in Titarus (CVE-2025-2405). Data can be tampered with by attackers. CVE-2025-2405 Dec 25, 2025
High 7.6 Cross-Site Scripting (XSS) in Trizbi Cross-site scripting in Trizbi (CVE-2025-2406). Data can be tampered with by attackers. CVE-2025-2406 Dec 25, 2025
Medium 6.4 Cross-Site Scripting (XSS) in ONLYOFFICE Docs Cross-site scripting in ONLYOFFICE Docs (CVE-2025-68917). Risk of unauthorized operations or information disclosure. CVE-2025-68917 Dec 25, 2025
Medium 5.5 Cross-Site Scripting (XSS) in Riello UPS NetMan 208 Application Cross-site scripting in Riello UPS NetMan 208 Application (CVE-2025-68915). Risk of unauthorized operations or information disclosure. CVE-2025-68915 Dec 25, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Specto CM Cross-site scripting in Specto CM (CVE-2025-2154). Risk of unauthorized operations or information disclosure. CVE-2025-2154 Dec 25, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Post Grid and Gutenberg Blocks Cross-site scripting in Post Grid and Gutenberg Blocks (CVE-2025-68605). Risk of unauthorized operations or information disclosure. CVE-2025-68605 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in YouTube Embed Cross-site scripting in YouTube Embed (CVE-2025-68599). Risk of unauthorized operations or information disclosure. CVE-2025-68599 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Jobs for WordPress Cross-site scripting in Jobs for WordPress (CVE-2025-68597). Risk of unauthorized operations or information disclosure. CVE-2025-68597 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Page Builder Cross-site scripting in Page Builder (CVE-2025-68598). Risk of unauthorized operations or information disclosure. CVE-2025-68598 Dec 24, 2025