Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.5 Cross-Site Scripting (XSS) in Ninja Popups Cross-site scripting in Ninja Popups (CVE-2025-63059). Risk of unauthorized operations or information disclosure. CVE-2025-63059 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in KALLYAS Cross-site scripting in KALLYAS (CVE-2025-63061). Risk of unauthorized operations or information disclosure. CVE-2025-63061 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in REHub Framework Cross-site scripting in REHub Framework (CVE-2025-63050). Risk of unauthorized operations or information disclosure. CVE-2025-63050 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in ListingPro Lead Form Cross-site scripting in ListingPro Lead Form (CVE-2025-63048). Risk of unauthorized operations or information disclosure. CVE-2025-63048 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in SimpLy Gallery Cross-site scripting in SimpLy Gallery (CVE-2025-63052). Risk of unauthorized operations or information disclosure. CVE-2025-63052 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Master Addons for Elementor Cross-site scripting in Master Addons for Elementor (CVE-2025-63055). Risk of unauthorized operations or information disclosure. CVE-2025-63055 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in WPLMS Cross-site scripting in WPLMS (CVE-2025-63035). Risk of unauthorized operations or information disclosure. CVE-2025-63035 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Ronneby Theme Core Cross-site scripting in Ronneby Theme Core (CVE-2025-63037). Risk of unauthorized operations or information disclosure. CVE-2025-63037 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Tutor LMS Elementor Addons Cross-site scripting in Tutor LMS Elementor Addons (CVE-2025-63042). Risk of unauthorized operations or information disclosure. CVE-2025-63042 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Xpro Elementor Addons Cross-site scripting in Xpro Elementor Addons (CVE-2025-63044). Risk of unauthorized operations or information disclosure. CVE-2025-63044 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in ListingPro Cross-site scripting in ListingPro (CVE-2025-63046). Risk of unauthorized operations or information disclosure. CVE-2025-63046 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Master Slider Pro Cross-site scripting in Master Slider Pro (CVE-2025-63045). Risk of unauthorized operations or information disclosure. CVE-2025-63045 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Make Section & Column Clickable For Elementor Cross-site scripting in Make Section & Column Clickable For Elementor (CVE-2025-63033). Risk of unauthorized operations or information disclosure. CVE-2025-63033 Dec 10, 2025
Medium 5.9 Cross-Site Scripting (XSS) in WP Hotel Booking Cross-site scripting in WP Hotel Booking (CVE-2025-63011). Risk of unauthorized operations or information disclosure. CVE-2025-63011 Dec 10, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Generic Elements Cross-site scripting in Generic Elements (CVE-2025-62082). Risk of unauthorized operations or information disclosure. CVE-2025-62082 Dec 10, 2025
Medium 4.6 Cross-Site Scripting (XSS) in Adata Cross-site scripting in Adata (CVE-2025-61074). Risk of unauthorized operations or information disclosure. CVE-2025-61074 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41748). Risk of unauthorized operations or information disclosure. CVE-2025-41748 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41749). Risk of unauthorized operations or information disclosure. CVE-2025-41749 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41751). Risk of unauthorized operations or information disclosure. CVE-2025-41751 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41750). Risk of unauthorized operations or information disclosure. CVE-2025-41750 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41752). Risk of unauthorized operations or information disclosure. CVE-2025-41752 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41745). Risk of unauthorized operations or information disclosure. CVE-2025-41745 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41746). Risk of unauthorized operations or information disclosure. CVE-2025-41746 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41747). Risk of unauthorized operations or information disclosure. CVE-2025-41747 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41695). Risk of unauthorized operations or information disclosure. CVE-2025-41695 Dec 10, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Tiptap Cross-site scripting in Tiptap (CVE-2025-14284). Risk of unauthorized operations or information disclosure. CVE-2025-14284 Dec 10, 2025
High 7.1 Cross-Site Scripting (XSS) in Custom Admin Menu (WordPress plugin) Cross-site scripting in Custom Admin Menu (WordPress plugin) (CVE-2025-13071). Risk of unauthorized operations or information disclosure. CVE-2025-13071 Dec 10, 2025
High 7.2 Cross-Site Scripting (XSS) in Login Security, FireWall, Malware removal by CleanTalk (WordPress plugin) Cross-site scripting in Login Security, FireWall, Malware removal by CleanTalk (WordPress plugin) (CVE-2025-13604). Risk of unauthorized operations or information disclosure. CVE-2025-13604 Dec 10, 2025
High 7.2 Cross-Site Scripting (XSS) in Social Reviews & Recommendations (WordPress plugin) Cross-site scripting in Social Reviews & Recommendations (WordPress plugin) (CVE-2025-12705). Risk of unauthorized operations or information disclosure. CVE-2025-12705 Dec 10, 2025
Medium 5.3 Cross-Site Scripting (XSS) in e-BAP Automation Cross-site scripting in e-BAP Automation (CVE-2025-10876). Risk of unauthorized operations or information disclosure. CVE-2025-10876 Dec 10, 2025