Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,208

Medium 5.5 Cross-Site Scripting (XSS) in BSK PDF Manager (WordPress plugin) Cross-site scripting in BSK PDF Manager (WordPress plugin) (CVE-2025-4970). Risk of unauthorized operations or information disclosure. CVE-2025-4970 Dec 12, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2025-67730). Risk of unauthorized operations or information disclosure. CVE-2025-67730 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in VikRentItems Flexible Rental Management System (WordPress plugin) Cross-site scripting in VikRentItems Flexible Rental Management System (WordPress plugin) (CVE-2025-14049). Risk of unauthorized operations or information disclosure. CVE-2025-14049 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Mailgun Subscriptions (WordPress plugin) Cross-site scripting in Mailgun Subscriptions (WordPress plugin) (CVE-2025-11876). Risk of unauthorized operations or information disclosure. CVE-2025-11876 Dec 12, 2025
High 7.2 Cross-Site Scripting (XSS) in Fancy Product Designer (WordPress plugin) Cross-site scripting in Fancy Product Designer (WordPress plugin) (CVE-2025-12570). Risk of unauthorized operations or information disclosure. CVE-2025-12570 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in GroupSession Free edition Cross-site scripting in GroupSession Free edition (CVE-2025-65120). Risk of unauthorized operations or information disclosure. CVE-2025-65120 Dec 12, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Groupsession Cross-site scripting in Groupsession (CVE-2025-66284). Risk of unauthorized operations or information disclosure. CVE-2025-66284 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in GroupSession Free edition Cross-site scripting in GroupSession Free edition (CVE-2025-57883). Risk of unauthorized operations or information disclosure. CVE-2025-57883 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in GroupSession Free edition Cross-site scripting in GroupSession Free edition (CVE-2025-54407). Risk of unauthorized operations or information disclosure. CVE-2025-54407 Dec 12, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Groupsession Cross-site scripting in Groupsession (CVE-2025-53523). Risk of unauthorized operations or information disclosure. CVE-2025-53523 Dec 12, 2025
High 8.2 Cross-Site Scripting (XSS) in Masa CMS Cross-site scripting in Masa CMS (CVE-2025-66492). Confidential information can be exposed externally. CVE-2025-66492 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Wpik WordPress Basic Ajax Form (WordPress plugin) Cross-site scripting in Wpik WordPress Basic Ajax Form (WordPress plugin) (CVE-2025-14393). Risk of unauthorized operations or information disclosure. CVE-2025-14393 Dec 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in WP Job Portal (WordPress plugin) Cross-site scripting in WP Job Portal (WordPress plugin) (CVE-2025-14467). Risk of unauthorized operations or information disclosure. Exploitable via WPJOBPORTAL_ALLOWED_TAGS. CVE-2025-14467 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Ayo Shortcodes (WordPress plugin) Cross-site scripting in Ayo Shortcodes (WordPress plugin) (CVE-2025-14143). Risk of unauthorized operations or information disclosure. CVE-2025-14143 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in WPLG Default Mail From (WordPress plugin) Cross-site scripting in WPLG Default Mail From (WordPress plugin) (CVE-2025-14138). Risk of unauthorized operations or information disclosure. CVE-2025-14138 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Simple AL Slider (WordPress plugin) Cross-site scripting in Simple AL Slider (WordPress plugin) (CVE-2025-14137). Risk of unauthorized operations or information disclosure. CVE-2025-14137 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Complag (WordPress plugin) Cross-site scripting in Complag (WordPress plugin) (CVE-2025-14125). Risk of unauthorized operations or information disclosure. CVE-2025-14125 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-14119). Risk of unauthorized operations or information disclosure. CVE-2025-14119 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Category Dropdown List (WordPress plugin) Cross-site scripting in Category Dropdown List (WordPress plugin) (CVE-2025-14132). Risk of unauthorized operations or information disclosure. CVE-2025-14132 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Like DisLike Voting (WordPress plugin) Cross-site scripting in Like DisLike Voting (WordPress plugin) (CVE-2025-14129). Risk of unauthorized operations or information disclosure. CVE-2025-14129 Dec 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in DebateMaster (WordPress plugin) Cross-site scripting in DebateMaster (WordPress plugin) (CVE-2025-14035). Risk of unauthorized operations or information disclosure. CVE-2025-14035 Dec 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in SimplyConvert (WordPress plugin) Cross-site scripting in SimplyConvert (WordPress plugin) (CVE-2025-14048). Risk of unauthorized operations or information disclosure. CVE-2025-14048 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Bold Timeline Lite (WordPress plugin) Cross-site scripting in Bold Timeline Lite (WordPress plugin) (CVE-2025-14032). Risk of unauthorized operations or information disclosure. CVE-2025-14032 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in 评论小秘书 (WordPress plugin) Cross-site scripting in 评论小秘书 (WordPress plugin) (CVE-2025-13988). Risk of unauthorized operations or information disclosure. CVE-2025-13988 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WP Dropzone (WordPress plugin) Cross-site scripting in WP Dropzone (WordPress plugin) (CVE-2025-13989). Risk of unauthorized operations or information disclosure. CVE-2025-13989 Dec 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13975). Risk of unauthorized operations or information disclosure. CVE-2025-13975 Dec 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in TWW Protein Calculator (WordPress plugin) Cross-site scripting in TWW Protein Calculator (WordPress plugin) (CVE-2025-13971). Risk of unauthorized operations or information disclosure. CVE-2025-13971 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Data Visualizer (WordPress plugin) Cross-site scripting in Data Visualizer (WordPress plugin) (CVE-2025-13961). Risk of unauthorized operations or information disclosure. CVE-2025-13961 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in FX Currency Converter (WordPress plugin) Cross-site scripting in FX Currency Converter (WordPress plugin) (CVE-2025-13963). Risk of unauthorized operations or information disclosure. CVE-2025-13963 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Divelogs Widget (WordPress plugin) Cross-site scripting in Divelogs Widget (WordPress plugin) (CVE-2025-13962). Risk of unauthorized operations or information disclosure. CVE-2025-13962 Dec 12, 2025