Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,208

Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-9856). Risk of unauthorized operations or information disclosure. CVE-2025-9856 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Livemesh SiteOrigin Widgets (WordPress plugin) Cross-site scripting in Livemesh SiteOrigin Widgets (WordPress plugin) (CVE-2025-8780). Risk of unauthorized operations or information disclosure. CVE-2025-8780 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Enter Addons (WordPress plugin) Cross-site scripting in Enter Addons (WordPress plugin) (CVE-2025-8687). Risk of unauthorized operations or information disclosure. CVE-2025-8687 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in All-in-One Addons for Elementor – WidgetKit (WordPress plugin) Cross-site scripting in All-in-One Addons for Elementor – WidgetKit (WordPress plugin) (CVE-2025-8779). Risk of unauthorized operations or information disclosure. CVE-2025-8779 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in YITH WooCommerce Quick View (WordPress plugin) Cross-site scripting in YITH WooCommerce Quick View (WordPress plugin) (CVE-2025-8617). Risk of unauthorized operations or information disclosure. CVE-2025-8617 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in King Addons for Elementor (WordPress plugin) Cross-site scripting in King Addons for Elementor (WordPress plugin) (CVE-2025-7960). Risk of unauthorized operations or information disclosure. CVE-2025-7960 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Kingcabs (WordPress theme) Cross-site scripting in Kingcabs (WordPress theme) (CVE-2025-7058). Risk of unauthorized operations or information disclosure. CVE-2025-7058 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in JetWidgets For Elementor (WordPress plugin) Cross-site scripting in JetWidgets For Elementor (WordPress plugin) (CVE-2025-8195). Risk of unauthorized operations or information disclosure. CVE-2025-8195 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in MarqueeAddons (WordPress plugin) Cross-site scripting in MarqueeAddons (WordPress plugin) (CVE-2025-8199). Risk of unauthorized operations or information disclosure. CVE-2025-8199 Dec 14, 2025
Medium 5.4 Cross-Site Scripting (XSS) in ShineLan-X Cross-site scripting in ShineLan-X (CVE-2025-36750). Risk of unauthorized operations or information disclosure. CVE-2025-36750 Dec 14, 2025
Medium 5.4 Cross-Site Scripting (XSS) in ShineLan-X Cross-site scripting in ShineLan-X (CVE-2025-36748). Risk of unauthorized operations or information disclosure. CVE-2025-36748 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in HT Slider for Elementor (WordPress plugin) Cross-site scripting in HT Slider for Elementor (WordPress plugin) (CVE-2025-14278). Risk of unauthorized operations or information disclosure. CVE-2025-14278 Dec 14, 2025
Medium 4.4 Cross-Site Scripting (XSS) in Quick Testimonials (WordPress plugin) Cross-site scripting in Quick Testimonials (WordPress plugin) (CVE-2025-14378). Risk of unauthorized operations or information disclosure. CVE-2025-14378 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Custom Frames (WordPress plugin) Cross-site scripting in Custom Frames (WordPress plugin) (CVE-2025-13705). Risk of unauthorized operations or information disclosure. CVE-2025-13705 Dec 14, 2025
Medium 4.4 Cross-Site Scripting (XSS) in Custom Post Type UI (WordPress plugin) Cross-site scripting in Custom Post Type UI (WordPress plugin) (CVE-2025-14056). Risk of unauthorized operations or information disclosure. CVE-2025-14056 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12109). Risk of unauthorized operations or information disclosure. CVE-2025-12109 Dec 14, 2025
Medium 6.1 Cross-Site Scripting (XSS) in WP to LinkedIn Auto Publish (WordPress plugin) Cross-site scripting in WP to LinkedIn Auto Publish (WordPress plugin) (CVE-2025-12077). Risk of unauthorized operations or information disclosure. CVE-2025-12077 Dec 14, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Social Media Auto Publish (WordPress plugin) Cross-site scripting in Social Media Auto Publish (WordPress plugin) (CVE-2025-12076). Risk of unauthorized operations or information disclosure. CVE-2025-12076 Dec 14, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Colibri Page Builder (WordPress plugin) Cross-site scripting in Colibri Page Builder (WordPress plugin) (CVE-2025-11376). Risk of unauthorized operations or information disclosure. CVE-2025-11376 Dec 14, 2025
Medium 6.3 Cross-Site Scripting (XSS) in vuetify Cross-site scripting in vuetify (CVE-2025-8082). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.0.0 or later. CVE-2025-8082 Dec 13, 2025
Medium 4.4 Cross-Site Scripting (XSS) in CISA Software Acquisition Guide Supplier Response Web Tool Cross-site scripting in CISA Software Acquisition Guide Supplier Response Web Tool (CVE-2025-67634). Risk of unauthorized operations or information disclosure. CVE-2025-67634 Dec 13, 2025
Low 3.5 Cross-Site Scripting (XSS) in Qualitor Cross-site scripting in Qualitor (CVE-2025-14580). Risk of unauthorized operations or information disclosure. CVE-2025-14580 Dec 13, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2025-67734). Risk of unauthorized operations or information disclosure. CVE-2025-67734 Dec 13, 2025
Medium 4.6 Cross-Site Scripting (XSS) in RuoYi Cross-site scripting in RuoYi (CVE-2025-67342). Risk of unauthorized operations or information disclosure. CVE-2025-67342 Dec 13, 2025
Medium 4.6 Cross-Site Scripting (XSS) in jshERP Cross-site scripting in jshERP (CVE-2025-67344). Risk of unauthorized operations or information disclosure. CVE-2025-67344 Dec 13, 2025
Medium 4.6 Cross-Site Scripting (XSS) in jshERP Cross-site scripting in jshERP (CVE-2025-67341). Risk of unauthorized operations or information disclosure. CVE-2025-67341 Dec 13, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Solaredge Cross-site scripting in Solaredge (CVE-2025-36746). Risk of unauthorized operations or information disclosure. CVE-2025-36746 Dec 13, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Magical Posts Display (WordPress plugin) Cross-site scripting in Magical Posts Display (WordPress plugin) (CVE-2025-12965). Risk of unauthorized operations or information disclosure. CVE-2025-12965 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in AI Feeds (WordPress plugin) Cross-site scripting in AI Feeds (WordPress plugin) (CVE-2025-14030). Risk of unauthorized operations or information disclosure. CVE-2025-14030 Dec 12, 2025
Medium 5.5 Cross-Site Scripting (XSS) in MailerLite – Signup forms (WordPress plugin) Cross-site scripting in MailerLite – Signup forms (WordPress plugin) (CVE-2025-13993). Risk of unauthorized operations or information disclosure. CVE-2025-13993 Dec 12, 2025