Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,213

Critical 9.3 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64539). Confidential information can be exposed externally. CVE-2025-64539 Dec 11, 2025
Critical 9.3 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64538). Confidential information can be exposed externally. CVE-2025-64538 Dec 11, 2025
Critical 9.3 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64537). Confidential information can be exposed externally. CVE-2025-64537 Dec 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Jenkins Cross-site scripting in Jenkins (CVE-2025-67641). Risk of unauthorized operations or information disclosure. CVE-2025-67641 Dec 11, 2025
Low 3.5 Cross-Site Scripting (XSS) in GoldenHorn Cross-site scripting in GoldenHorn (CVE-2025-13127). Risk of unauthorized operations or information disclosure. CVE-2025-13127 Dec 10, 2025
Medium 4.3 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2025-67496). Risk of unauthorized operations or information disclosure. CVE-2025-67496 Dec 10, 2025
High 8.0 Cross-Site Scripting (XSS) in ZITADEL Cross-site scripting in ZITADEL (CVE-2025-67495). Confidential information can be exposed externally. CVE-2025-67495 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34425). Risk of unauthorized operations or information disclosure. CVE-2025-34425 Dec 10, 2025
Medium 5.4 Cross-Site Scripting (XSS) in e-BAP Automation Cross-site scripting in e-BAP Automation (CVE-2025-6924). Risk of unauthorized operations or information disclosure. CVE-2025-6924 Dec 10, 2025
Medium 5.4 Cross-Site Scripting (XSS) in UNIS Cross-site scripting in UNIS (CVE-2025-6923). Risk of unauthorized operations or information disclosure. CVE-2025-6923 Dec 10, 2025
High 8.8 Cross-Site Scripting (XSS) in Microsoft Sharepoint Server Cross-site scripting in Microsoft Sharepoint Server (CVE-2025-64672). Successful exploitation can lead to full system takeover. CVE-2025-64672 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Phpipam Cross-site scripting in Phpipam (CVE-2025-61078). Risk of unauthorized operations or information disclosure. CVE-2025-61078 Dec 10, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fortinet FortiSandbox Cross-site scripting in Fortinet FortiSandbox (CVE-2025-54353). Risk of unauthorized operations or information disclosure. CVE-2025-54353 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34409). Risk of unauthorized operations or information disclosure. CVE-2025-34409 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34406). Risk of unauthorized operations or information disclosure. CVE-2025-34406 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34408). Risk of unauthorized operations or information disclosure. CVE-2025-34408 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34407). Risk of unauthorized operations or information disclosure. CVE-2025-34407 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34400). Risk of unauthorized operations or information disclosure. CVE-2025-34400 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34398). Risk of unauthorized operations or information disclosure. CVE-2025-34398 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34402). Risk of unauthorized operations or information disclosure. CVE-2025-34402 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34399). Risk of unauthorized operations or information disclosure. CVE-2025-34399 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34404). Risk of unauthorized operations or information disclosure. CVE-2025-34404 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34401). Risk of unauthorized operations or information disclosure. CVE-2025-34401 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34403). Risk of unauthorized operations or information disclosure. CVE-2025-34403 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34397). Risk of unauthorized operations or information disclosure. CVE-2025-34397 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Mercurycom Cross-site scripting in Mercurycom (CVE-2025-65289). Risk of unauthorized operations or information disclosure. CVE-2025-65289 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Xinhu Rainrock RockOA Cross-site scripting in Xinhu Rainrock RockOA (CVE-2025-63737). Risk of unauthorized operations or information disclosure. CVE-2025-63737 Dec 10, 2025
Medium 4.8 Cross-Site Scripting (XSS) in i-Educar Cross-site scripting in i-Educar (CVE-2025-9638). Risk of unauthorized operations or information disclosure. CVE-2025-9638 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Rencontre Cross-site scripting in Rencontre (CVE-2025-67558). Risk of unauthorized operations or information disclosure. CVE-2025-67558 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in WordPress WP eBay Product Feeds Cross-site scripting in WordPress WP eBay Product Feeds (CVE-2025-67557). Risk of unauthorized operations or information disclosure. CVE-2025-67557 Dec 10, 2025