Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,208

Medium 6.1 Cross-Site Scripting (XSS) in Sale Cross-site scripting in Sale (CVE-2025-66924). Risk of unauthorized operations or information disclosure. CVE-2025-66924 Dec 18, 2025
High 7.2 Vulnerability in Sale CVE-2025-66923 Dec 18, 2025
High 7.2 Vulnerability in Sale CVE-2025-66921 Dec 18, 2025
Medium 6.3 Cross-Site Scripting (XSS) in OBS (Student Affairs Information System)0 Cross-site scripting in OBS (Student Affairs Information System)0 (CVE-2025-14347). Confidential information can be exposed externally. CVE-2025-14347 Dec 17, 2025
High 7.1 Cross-Site Scripting (XSS) in Crafty Controller Cross-site scripting in Crafty Controller (CVE-2025-14701). Confidential information can be exposed externally. CVE-2025-14701 Dec 17, 2025
Medium 5.4 Cross-Site Scripting (XSS) in nopCommerce Cross-site scripting in nopCommerce (CVE-2025-65591). Risk of unauthorized operations or information disclosure. CVE-2025-65591 Dec 17, 2025
Medium 6.1 Cross-Site Scripting (XSS) in nopCommerce Cross-site scripting in nopCommerce (CVE-2025-65592). Risk of unauthorized operations or information disclosure. CVE-2025-65592 Dec 17, 2025
Medium 5.4 Cross-Site Scripting (XSS) in nopCommerce Cross-site scripting in nopCommerce (CVE-2025-65590). Risk of unauthorized operations or information disclosure. CVE-2025-65590 Dec 17, 2025
Medium 6.1 Cross-Site Scripting (XSS) in nopCommerce Cross-site scripting in nopCommerce (CVE-2025-65589). Risk of unauthorized operations or information disclosure. CVE-2025-65589 Dec 17, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Glpi Cross-site scripting in Glpi (CVE-2025-59935). Confidential information can be exposed externally. CVE-2025-59935 Dec 17, 2025
Medium 6.5 Cross-Site Scripting (XSS) in VK Google Job Posting Manager Cross-site scripting in VK Google Job Posting Manager (CVE-2025-68070). Risk of unauthorized operations or information disclosure. CVE-2025-68070 Dec 16, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Parse Server's password reset Cross-site scripting in Parse Server's password reset (CVE-2025-68115). Risk of unauthorized operations or information disclosure. CVE-2025-68115 Dec 16, 2025
Low 2.4 Cross-Site Scripting (XSS) in vion707 DMadmin Cross-site scripting in vion707 DMadmin (CVE-2025-14722). Risk of unauthorized operations or information disclosure. CVE-2025-14722 Dec 16, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MicroStudio Cross-site scripting in MicroStudio (CVE-2025-51962). Risk of unauthorized operations or information disclosure. CVE-2025-51962 Dec 16, 2025
Medium 5.4 Cross-Site Scripting (XSS) in grav Cross-site scripting in grav (CVE-2025-66843). Risk of unauthorized operations or information disclosure. CVE-2025-66843 Dec 16, 2025
Medium 6.4 Cross-Site Scripting (XSS) in LearnPress – WordPress LMS Plugin (WordPress plugin) Cross-site scripting in LearnPress – WordPress LMS Plugin (WordPress plugin) (CVE-2025-14387). Risk of unauthorized operations or information disclosure. CVE-2025-14387 Dec 16, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13728). Risk of unauthorized operations or information disclosure. Exploitable via fluent_auth_reset_password. CVE-2025-13728 Dec 16, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13367). Risk of unauthorized operations or information disclosure. CVE-2025-13367 Dec 16, 2025
Medium 6.4 Cross-Site Scripting (XSS) in CC Child Pages (WordPress plugin) Cross-site scripting in CC Child Pages (WordPress plugin) (CVE-2025-13608). Risk of unauthorized operations or information disclosure. CVE-2025-13608 Dec 16, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13610). Risk of unauthorized operations or information disclosure. CVE-2025-13610 Dec 16, 2025
High 8.1 Cross-Site Scripting (XSS) in Wekan The Open Source kanban board system Cross-site scripting in Wekan The Open Source kanban board system (CVE-2025-65778). Confidential information can be exposed externally. Mitigation: upgrade to 18.16 or later. CVE-2025-65778 Dec 15, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Elastic Kibana Cross-site scripting in Elastic Kibana (CVE-2025-37732). Risk of unauthorized operations or information disclosure. CVE-2025-37732 Dec 15, 2025
Medium 5.4 Cross-Site Scripting (XSS) in MISP Cross-site scripting in MISP (CVE-2025-67906). Risk of unauthorized operations or information disclosure. CVE-2025-67906 Dec 15, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Lightweight Accordion (WordPress plugin) Cross-site scripting in Lightweight Accordion (WordPress plugin) (CVE-2025-13740). Risk of unauthorized operations or information disclosure. CVE-2025-13740 Dec 15, 2025
Medium 4.3 Cross-Site Scripting (XSS) in mayan-edms Cross-site scripting in mayan-edms (CVE-2025-14691). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 4.10.2 or later. CVE-2025-14691 Dec 15, 2025
Low 2.4 Cross-Site Scripting (XSS) in code-projects Student File Management System Cross-site scripting in code-projects Student File Management System (CVE-2025-14663). Risk of unauthorized operations or information disclosure. CVE-2025-14663 Dec 14, 2025
Low 2.4 Cross-Site Scripting (XSS) in code-projects Student File Management System Cross-site scripting in code-projects Student File Management System (CVE-2025-14662). Risk of unauthorized operations or information disclosure. CVE-2025-14662 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Addon Elements for Elementor (WordPress plugin) Cross-site scripting in Addon Elements for Elementor (WordPress plugin) (CVE-2025-12537). Risk of unauthorized operations or information disclosure. CVE-2025-12537 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in a3 Lazy Load (WordPress plugin) Cross-site scripting in a3 Lazy Load (WordPress plugin) (CVE-2025-9873). Risk of unauthorized operations or information disclosure. CVE-2025-9873 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Redux Framework (WordPress plugin) Cross-site scripting in Redux Framework (WordPress plugin) (CVE-2025-9488). Risk of unauthorized operations or information disclosure. CVE-2025-9488 Dec 14, 2025