Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,208

Critical 9.6 Cross-Site Scripting (XSS) in Frappe Framework Cross-site scripting in Frappe Framework (CVE-2025-67289). Successful exploitation can lead to full system takeover. CVE-2025-67289 Dec 23, 2025
Medium 6.8 Cross-Site Scripting (XSS) in Infra Monitoring Cross-site scripting in Infra Monitoring (CVE-2025-54890). Confidential information can be exposed externally. CVE-2025-54890 Dec 22, 2025
Medium 6.8 Cross-Site Scripting (XSS) in Infra Monitoring Cross-site scripting in Infra Monitoring (CVE-2025-8460). Confidential information can be exposed externally. CVE-2025-8460 Dec 22, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Void Elementor WHMCS Elements For Elementor Page Builder Cross-site scripting in Void Elementor WHMCS Elements For Elementor Page Builder (CVE-2025-62094). Risk of unauthorized operations or information disclosure. CVE-2025-62094 Dec 22, 2025
Medium 6.5 Cross-Site Scripting (XSS) in WP Microdata Cross-site scripting in WP Microdata (CVE-2025-62901). Risk of unauthorized operations or information disclosure. CVE-2025-62901 Dec 22, 2025
Medium 6.5 Cross-Site Scripting (XSS) in TempTool [Show Current Template Info] Cross-site scripting in TempTool [Show Current Template Info] (CVE-2025-62926). Risk of unauthorized operations or information disclosure. CVE-2025-62926 Dec 22, 2025
High 7.2 Cross-Site Scripting (XSS) in SureForms (WordPress plugin) Cross-site scripting in SureForms (WordPress plugin) (CVE-2025-14855). Risk of unauthorized operations or information disclosure. CVE-2025-14855 Dec 21, 2025
High 7.2 Cross-Site Scripting (XSS) in ELEX WordPress HelpDesk & Customer Ticketing System (WordPress plugin) Cross-site scripting in ELEX WordPress HelpDesk & Customer Ticketing System (WordPress plugin) (CVE-2025-9343). Risk of unauthorized operations or information disclosure. CVE-2025-9343 Dec 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Image Photo Gallery Final Tiles Grid (WordPress plugin) Cross-site scripting in Image Photo Gallery Final Tiles Grid (WordPress plugin) (CVE-2025-13693). Risk of unauthorized operations or information disclosure. CVE-2025-13693 Dec 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13220). Risk of unauthorized operations or information disclosure. CVE-2025-13220 Dec 21, 2025
Low 2.4 Cross-Site Scripting (XSS) in Campcodes Complete Online Beauty Parlor Management System Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System (CVE-2025-14991). Risk of unauthorized operations or information disclosure. CVE-2025-14991 Dec 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Product Table for WooCommerce (WordPress plugin) Cross-site scripting in Product Table for WooCommerce (WordPress plugin) (CVE-2025-12398). Risk of unauthorized operations or information disclosure. CVE-2025-12398 Dec 21, 2025
Medium 4.4 Cross-Site Scripting (XSS) in WC Builder – WooCommerce Page Builder for WPBakery (WordPress plugin) Cross-site scripting in WC Builder – WooCommerce Page Builder for WPBakery (WordPress plugin) (CVE-2025-14054). Risk of unauthorized operations or information disclosure. CVE-2025-14054 Dec 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WishSuite (WordPress plugin) Cross-site scripting in WishSuite (WordPress plugin) (CVE-2025-13838). Risk of unauthorized operations or information disclosure. CVE-2025-13838 Dec 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Five Star Restaurant Reservations – WordPress Booking Plugin (WordPress plugin) Cross-site scripting in Five Star Restaurant Reservations – WordPress Booking Plugin (WordPress plugin) (CVE-2025-11496). Risk of unauthorized operations or information disclosure. CVE-2025-11496 Dec 21, 2025
Medium 5.5 Cross-Site Scripting (XSS) in Responsive and Swipe slider (WordPress plugin) Cross-site scripting in Responsive and Swipe slider (WordPress plugin) (CVE-2025-14721). Risk of unauthorized operations or information disclosure. CVE-2025-14721 Dec 20, 2025
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Stock System Cross-site scripting in code-projects Simple Stock System (CVE-2025-14962). Risk of unauthorized operations or information disclosure. CVE-2025-14962 Dec 20, 2025
High 7.2 Cross-Site Scripting (XSS) in SlimStat Analytics (WordPress plugin) Cross-site scripting in SlimStat Analytics (WordPress plugin) (CVE-2025-14151). Risk of unauthorized operations or information disclosure. CVE-2025-14151 Dec 19, 2025
Medium 6.3 Cross-Site Scripting (XSS) in Foxit Cross-site scripting in Foxit (CVE-2025-66519). Confidential information can be exposed externally. CVE-2025-66519 Dec 19, 2025
Medium 6.3 Cross-Site Scripting (XSS) in Foxit Cross-site scripting in Foxit (CVE-2025-66502). Confidential information can be exposed externally. CVE-2025-66502 Dec 19, 2025
High 8.2 Cross-Site Scripting (XSS) in Office Out-of-Box Experience Cross-site scripting in Office Out-of-Box Experience (CVE-2025-64677). Confidential information can be exposed externally. CVE-2025-64677 Dec 19, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Yohanawi Cross-site scripting in Yohanawi (CVE-2025-63949). Risk of unauthorized operations or information disclosure. CVE-2025-63949 Dec 19, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Craigtaub Cross-site scripting in Craigtaub (CVE-2025-63947). Risk of unauthorized operations or information disclosure. CVE-2025-63947 Dec 19, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Applications Manager Cross-site scripting in Zohocorp ManageEngine Applications Manager (CVE-2025-9787). Confidential information can be exposed externally. CVE-2025-9787 Dec 19, 2025
Medium 4.7 Cross-Site Scripting (XSS) in Nozominetworks Cross-site scripting in Nozominetworks (CVE-2025-40891). Risk of unauthorized operations or information disclosure. CVE-2025-40891 Dec 18, 2025
Unrated A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG… Cross-site scripting reported (CVE-2025-14202). Risk of unauthorized operations or information disclosure. CVE-2025-14202 Dec 18, 2025
High 8.1 Cross-Site Scripting (XSS) in Return Policy" configuration field Cross-site scripting in Return Policy" configuration field (CVE-2025-68147). Confidential information can be exposed externally. CVE-2025-68147 Dec 18, 2025
Medium 5.4 Cross-Site Scripting (XSS) in ChurchCRM Cross-site scripting in ChurchCRM (CVE-2025-67875). Risk of unauthorized operations or information disclosure. CVE-2025-67875 Dec 18, 2025
Critical 9.6 Cross-Site Scripting (XSS) in DriveLock Operations Center Cross-site scripting in DriveLock Operations Center (CVE-2025-67787). Confidential information can be exposed externally. CVE-2025-67787 Dec 18, 2025
Medium 6.1 Cross-Site Scripting (XSS) in SLiMS Cross-site scripting in SLiMS (CVE-2025-65233). Risk of unauthorized operations or information disclosure. CVE-2025-65233 Dec 18, 2025