Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,213

Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13975). Risk of unauthorized operations or information disclosure. CVE-2025-13975 Dec 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in TWW Protein Calculator (WordPress plugin) Cross-site scripting in TWW Protein Calculator (WordPress plugin) (CVE-2025-13971). Risk of unauthorized operations or information disclosure. CVE-2025-13971 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Data Visualizer (WordPress plugin) Cross-site scripting in Data Visualizer (WordPress plugin) (CVE-2025-13961). Risk of unauthorized operations or information disclosure. CVE-2025-13961 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Divelogs Widget (WordPress plugin) Cross-site scripting in Divelogs Widget (WordPress plugin) (CVE-2025-13962). Risk of unauthorized operations or information disclosure. CVE-2025-13962 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Paypal Payment Shortcode (WordPress plugin) Cross-site scripting in Paypal Payment Shortcode (WordPress plugin) (CVE-2025-13966). Risk of unauthorized operations or information disclosure. CVE-2025-13966 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in FX Currency Converter (WordPress plugin) Cross-site scripting in FX Currency Converter (WordPress plugin) (CVE-2025-13963). Risk of unauthorized operations or information disclosure. CVE-2025-13963 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Reviews Sorted (WordPress plugin) Cross-site scripting in Reviews Sorted (WordPress plugin) (CVE-2025-13969). Risk of unauthorized operations or information disclosure. CVE-2025-13969 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WPGancio (WordPress plugin) Cross-site scripting in WPGancio (WordPress plugin) (CVE-2025-13904). Risk of unauthorized operations or information disclosure. CVE-2025-13904 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Simple Nivo Slider (WordPress plugin) Cross-site scripting in Simple Nivo Slider (WordPress plugin) (CVE-2025-13889). Risk of unauthorized operations or information disclosure. CVE-2025-13889 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Zenost Shortcodes (WordPress plugin) Cross-site scripting in Zenost Shortcodes (WordPress plugin) (CVE-2025-13885). Risk of unauthorized operations or information disclosure. Exploitable via button. CVE-2025-13885 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WP Flot (WordPress plugin) Cross-site scripting in WP Flot (WordPress plugin) (CVE-2025-13906). Risk of unauthorized operations or information disclosure. CVE-2025-13906 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in GPXpress (WordPress plugin) Cross-site scripting in GPXpress (WordPress plugin) (CVE-2025-13960). Risk of unauthorized operations or information disclosure. CVE-2025-13960 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Hide Email Address (WordPress plugin) Cross-site scripting in Hide Email Address (WordPress plugin) (CVE-2025-13884). Risk of unauthorized operations or information disclosure. CVE-2025-13884 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in LS Google Map Router (WordPress plugin) Cross-site scripting in LS Google Map Router (WordPress plugin) (CVE-2025-13850). Risk of unauthorized operations or information disclosure. CVE-2025-13850 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in VigLink SpotLight By ShortCode (WordPress plugin) Cross-site scripting in VigLink SpotLight By ShortCode (WordPress plugin) (CVE-2025-13843). Risk of unauthorized operations or information disclosure. CVE-2025-13843 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in BUKAZU Search widget (WordPress plugin) Cross-site scripting in BUKAZU Search widget (WordPress plugin) (CVE-2025-13840). Risk of unauthorized operations or information disclosure. CVE-2025-13840 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Easy Map Creator (WordPress plugin) Cross-site scripting in Easy Map Creator (WordPress plugin) (CVE-2025-13846). Risk of unauthorized operations or information disclosure. CVE-2025-13846 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in NewStatPress (WordPress plugin) Cross-site scripting in NewStatPress (WordPress plugin) (CVE-2025-13747). Risk of unauthorized operations or information disclosure. CVE-2025-13747 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Accept Stripe Payments Using Contact Form (WordPress plugin) Cross-site scripting in Accept Stripe Payments Using Contact Form (WordPress plugin) (CVE-2025-12834). Risk of unauthorized operations or information disclosure. CVE-2025-12834 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Better Elementor Addons (WordPress plugin) Cross-site scripting in Better Elementor Addons (WordPress plugin) (CVE-2025-12830). Risk of unauthorized operations or information disclosure. CVE-2025-12830 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Simple post listing (WordPress plugin) Cross-site scripting in Simple post listing (WordPress plugin) (CVE-2025-12650). Risk of unauthorized operations or information disclosure. CVE-2025-12650 Dec 12, 2025
Medium 6.4 Cross-Site Scripting (XSS) in LJUsers (WordPress plugin) Cross-site scripting in LJUsers (WordPress plugin) (CVE-2025-13839). Risk of unauthorized operations or information disclosure. CVE-2025-13839 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in LibreChat Cross-site scripting in LibreChat (CVE-2025-66452). Risk of unauthorized operations or information disclosure. CVE-2025-66452 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in SPA-CART CMS Cross-site scripting in SPA-CART CMS (CVE-2024-58304). Risk of unauthorized operations or information disclosure. CVE-2024-58304 Dec 12, 2025
Unrated Cross-Site Scripting (XSS) in XMB Forum Cross-site scripting in XMB Forum (CVE-2024-58292). Risk of unauthorized operations or information disclosure. CVE-2024-58292 Dec 12, 2025
Unrated Cross-Site Scripting (XSS) in CE Phoenix Cross-site scripting in CE Phoenix (CVE-2024-58296). Risk of unauthorized operations or information disclosure. CVE-2024-58296 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in HotelDruid Cross-site scripting in HotelDruid (CVE-2025-55816). Risk of unauthorized operations or information disclosure. CVE-2025-55816 Dec 12, 2025
Low 3.5 Cross-Site Scripting (XSS) in yangshare warehouseManager 仓库管理系统 Cross-site scripting in yangshare warehouseManager 仓库管理系统 (CVE-2025-14538). Risk of unauthorized operations or information disclosure. CVE-2025-14538 Dec 12, 2025
High 8.8 Vulnerability in edoc-doctor-appointment-system CVE-2025-66918 Dec 12, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Github Cross-site scripting in Github (CVE-2025-14046). Risk of unauthorized operations or information disclosure. CVE-2025-14046 Dec 12, 2025