Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34397). Risk of unauthorized operations or information disclosure. CVE-2025-34397 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Mercurycom Cross-site scripting in Mercurycom (CVE-2025-65289). Risk of unauthorized operations or information disclosure. CVE-2025-65289 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Xinhu Rainrock RockOA Cross-site scripting in Xinhu Rainrock RockOA (CVE-2025-63737). Risk of unauthorized operations or information disclosure. CVE-2025-63737 Dec 10, 2025
Medium 4.8 Cross-Site Scripting (XSS) in i-Educar Cross-site scripting in i-Educar (CVE-2025-9638). Risk of unauthorized operations or information disclosure. CVE-2025-9638 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Rencontre Cross-site scripting in Rencontre (CVE-2025-67558). Risk of unauthorized operations or information disclosure. CVE-2025-67558 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in WordPress WP eBay Product Feeds Cross-site scripting in WordPress WP eBay Product Feeds (CVE-2025-67557). Risk of unauthorized operations or information disclosure. CVE-2025-67557 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Advanced FAQ Manager Cross-site scripting in Advanced FAQ Manager (CVE-2025-67556). Risk of unauthorized operations or information disclosure. CVE-2025-67556 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Advanced FAQ Manager Cross-site scripting in Advanced FAQ Manager (CVE-2025-67553). Risk of unauthorized operations or information disclosure. CVE-2025-67553 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Walker Core Cross-site scripting in Walker Core (CVE-2025-67552). Risk of unauthorized operations or information disclosure. CVE-2025-67552 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Cookie Notice & Compliance for GDPR / CCPA Cross-site scripting in Cookie Notice & Compliance for GDPR / CCPA (CVE-2025-67554). Risk of unauthorized operations or information disclosure. CVE-2025-67554 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in UseStrict's Calendly Embedder Cross-site scripting in UseStrict's Calendly Embedder (CVE-2025-67555). Risk of unauthorized operations or information disclosure. CVE-2025-67555 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Wappointment Cross-site scripting in Wappointment (CVE-2025-67551). Risk of unauthorized operations or information disclosure. CVE-2025-67551 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in oik Cross-site scripting in oik (CVE-2025-67549). Risk of unauthorized operations or information disclosure. CVE-2025-67549 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in FireBox Cross-site scripting in FireBox (CVE-2025-67545). Risk of unauthorized operations or information disclosure. CVE-2025-67545 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Donation Thermometer Cross-site scripting in Donation Thermometer (CVE-2025-67550). Risk of unauthorized operations or information disclosure. CVE-2025-67550 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Shopkeeper Extender Cross-site scripting in Shopkeeper Extender (CVE-2025-67544). Risk of unauthorized operations or information disclosure. CVE-2025-67544 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Multi-Step Checkout for WooCommerce Cross-site scripting in Multi-Step Checkout for WooCommerce (CVE-2025-67542). Risk of unauthorized operations or information disclosure. CVE-2025-67542 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in WP-ShowHide Cross-site scripting in WP-ShowHide (CVE-2025-67541). Risk of unauthorized operations or information disclosure. CVE-2025-67541 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Select Core Cross-site scripting in Select Core (CVE-2025-67539). Risk of unauthorized operations or information disclosure. CVE-2025-67539 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Essential Widgets Cross-site scripting in Essential Widgets (CVE-2025-67543). Risk of unauthorized operations or information disclosure. CVE-2025-67543 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Themify Portfolio Post Cross-site scripting in Themify Portfolio Post (CVE-2025-67533). Risk of unauthorized operations or information disclosure. CVE-2025-67533 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in JNews Gallery Cross-site scripting in JNews Gallery (CVE-2025-67538). Risk of unauthorized operations or information disclosure. CVE-2025-67538 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in ThirstyAffiliates Cross-site scripting in ThirstyAffiliates (CVE-2025-67537). Risk of unauthorized operations or information disclosure. CVE-2025-67537 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in LearnPress Cross-site scripting in LearnPress (CVE-2025-67536). Risk of unauthorized operations or information disclosure. CVE-2025-67536 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in The7 Cross-site scripting in The7 (CVE-2025-63073). Risk of unauthorized operations or information disclosure. CVE-2025-63073 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Betheme Cross-site scripting in Betheme (CVE-2025-63075). Risk of unauthorized operations or information disclosure. CVE-2025-63075 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Cornerstone Cross-site scripting in Cornerstone (CVE-2025-63072). Risk of unauthorized operations or information disclosure. CVE-2025-63072 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in EventON Cross-site scripting in EventON (CVE-2025-63064). Risk of unauthorized operations or information disclosure. CVE-2025-63064 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Porto Theme - Functionality Cross-site scripting in Porto Theme - Functionality (CVE-2025-63066). Risk of unauthorized operations or information disclosure. CVE-2025-63066 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Ninja Popups Cross-site scripting in Ninja Popups (CVE-2025-63059). Risk of unauthorized operations or information disclosure. CVE-2025-63059 Dec 10, 2025