Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,208

Medium 5.9 Cross-Site Scripting (XSS) in WPBakery Visual Composer WHMCS Elements Cross-site scripting in WPBakery Visual Composer WHMCS Elements (CVE-2025-68574). Risk of unauthorized operations or information disclosure. CVE-2025-68574 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in My auctions allegro Cross-site scripting in My auctions allegro (CVE-2025-68566). Risk of unauthorized operations or information disclosure. CVE-2025-68566 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in WC Builder Cross-site scripting in WC Builder (CVE-2025-68533). Risk of unauthorized operations or information disclosure. CVE-2025-68533 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in ModelTheme Addons for WPBakery and Elementor Cross-site scripting in ModelTheme Addons for WPBakery and Elementor (CVE-2025-68532). Risk of unauthorized operations or information disclosure. CVE-2025-68532 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Free Shipping Bar Cross-site scripting in Free Shipping Bar (CVE-2025-68528). Risk of unauthorized operations or information disclosure. CVE-2025-68528 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Academy LMS Cross-site scripting in Academy LMS (CVE-2025-68527). Risk of unauthorized operations or information disclosure. CVE-2025-68527 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Category Icon Cross-site scripting in Category Icon (CVE-2025-68525). Risk of unauthorized operations or information disclosure. CVE-2025-68525 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Bold Timeline Lite Cross-site scripting in Bold Timeline Lite (CVE-2025-68513). Risk of unauthorized operations or information disclosure. CVE-2025-68513 Dec 24, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Real 3D FlipBook Cross-site scripting in Real 3D FlipBook (CVE-2025-68512). Risk of unauthorized operations or information disclosure. CVE-2025-68512 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Astra Widgets Cross-site scripting in Astra Widgets (CVE-2025-68497). Risk of unauthorized operations or information disclosure. CVE-2025-68497 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in WH Tweaks Cross-site scripting in WH Tweaks (CVE-2025-67630). Risk of unauthorized operations or information disclosure. CVE-2025-67630 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Google AdSense for Responsive Design – GARD Cross-site scripting in Google AdSense for Responsive Design – GARD (CVE-2025-67632). Risk of unauthorized operations or information disclosure. CVE-2025-67632 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Basticom Framework Cross-site scripting in Basticom Framework (CVE-2025-67629). Risk of unauthorized operations or information disclosure. CVE-2025-67629 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Greenhouse Job Board Cross-site scripting in Greenhouse Job Board (CVE-2025-67633). Risk of unauthorized operations or information disclosure. CVE-2025-67633 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Gift Hunt Cross-site scripting in Gift Hunt (CVE-2025-67631). Risk of unauthorized operations or information disclosure. CVE-2025-67631 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Review Disclaimer Cross-site scripting in Review Disclaimer (CVE-2025-67628). Risk of unauthorized operations or information disclosure. CVE-2025-67628 Dec 24, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Draft Notify Cross-site scripting in Draft Notify (CVE-2025-67627). Risk of unauthorized operations or information disclosure. CVE-2025-67627 Dec 24, 2025
High 8.2 Cross-Site Scripting (XSS) in Hitachi Infrastructure Analytics Advisor Cross-site scripting in Hitachi Infrastructure Analytics Advisor (CVE-2025-66444). Confidential information can be exposed externally. CVE-2025-66444 Dec 24, 2025
Low 3.5 Cross-Site Scripting (XSS) in code-projects Student Information System Cross-site scripting in code-projects Student Information System (CVE-2025-15052). Risk of unauthorized operations or information disclosure. CVE-2025-15052 Dec 24, 2025
Critical 9.6 Cross-Site Scripting (XSS) in 5ire Cross-site scripting in 5ire (CVE-2025-68669). Successful exploitation can lead to full system takeover. CVE-2025-68669 Dec 24, 2025
High 8.8 IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to… Cross-site scripting reported (CVE-2025-14499). Successful exploitation can lead to full system takeover. CVE-2025-14499 Dec 24, 2025
High 7.3 Cross-Site Scripting (XSS) in Otello Cross-site scripting in Otello (CVE-2025-13183). Confidential information can be exposed externally. CVE-2025-13183 Dec 23, 2025
Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-68559). Risk of unauthorized operations or information disclosure. CVE-2025-68559 Dec 23, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Responsive Posts Carousel Pro Cross-site scripting in Responsive Posts Carousel Pro (CVE-2025-68548). Risk of unauthorized operations or information disclosure. CVE-2025-68548 Dec 23, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Happy Addons for Elementor (WordPress plugin) Cross-site scripting in Happy Addons for Elementor (WordPress plugin) (CVE-2025-14635). Risk of unauthorized operations or information disclosure. CVE-2025-14635 Dec 23, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Membership Plugin – Restrict Content (WordPress plugin) Cross-site scripting in Membership Plugin – Restrict Content (WordPress plugin) (CVE-2025-14000). Risk of unauthorized operations or information disclosure. CVE-2025-14000 Dec 23, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Calendar (WordPress plugin) Cross-site scripting in Calendar (WordPress plugin) (CVE-2025-14548). Risk of unauthorized operations or information disclosure. CVE-2025-14548 Dec 23, 2025
Medium 4.3 Cross-Site Scripting (XSS) in LibreNMS Cross-site scripting in LibreNMS (CVE-2025-68614). Risk of unauthorized operations or information disclosure. CVE-2025-68614 Dec 23, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Piranha CMS Cross-site scripting in Piranha CMS (CVE-2025-67290). Risk of unauthorized operations or information disclosure. CVE-2025-67290 Dec 23, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Piranha CMS Cross-site scripting in Piranha CMS (CVE-2025-67291). Risk of unauthorized operations or information disclosure. CVE-2025-67291 Dec 23, 2025