Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,692
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 8,728

Image ID Title
CVE-2026-104393 Cross-Site Scripting (XSS) in Happy Addons for Elementor (CVE-2026-104393)
CVE-2026-104391 Cross-Site Scripting (XSS) in Quiz And Survey Master (CVE-2026-104391)
CVE-2026-93684 An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put...
CVE-2026-89417 Cross-Site Scripting (XSS) in WordPress Apache (CVE-2026-89417)
CVE-2025-64392 Cross-Site Scripting (XSS) in Veeam Backup Enterprise Manager (CVE-2025-64392)
CVE-2026-87971 Cross-Site Scripting (XSS) in If-So Dynamic Content (WordPress plugin) (CVE-2026-87971)
CVE-2026-105316 Cross-Site Scripting (XSS) in Magee Shortcodes (WordPress plugin) (CVE-2026-105316)
CVE-2026-104653 Cross-Site Scripting (XSS) in Envira Gallery (WordPress plugin) (CVE-2026-104653)
CVE-2026-104652 Cross-Site Scripting (XSS) in Envira Gallery (WordPress plugin) (CVE-2026-104652)
CVE-2026-102173 Cross-Site Scripting (XSS) in WordPress (CVE-2026-102173)
CVE-2026-14911 Cross-Site Scripting (XSS) in ASUS (CVE-2026-14911)
CVE-2026-96594 Cross-Site Scripting (XSS) in Gitea (CVE-2026-96594)
CVE-2026-79816 Cross-Site Scripting (XSS) in HPE Networking ClearPass Policy Manager (CVE-2026-79816)
CVE-2026-79799 Cross-Site Scripting (XSS) in ClearPass Policy Manager (CVE-2026-79799)
CVE-2026-105111 Cross-Site Scripting (XSS) in Apache (CVE-2026-105111)
CVE-2026-103667 Cross-Site Scripting (XSS) in Gitea (CVE-2026-103667)
CVE-2026-101158 Cross-Site Scripting (XSS) in Fileserver upload API (CVE-2026-101158)
CVE-2026-101156 A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege...
CVE-2026-101157 A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with...
CVE-2026-106512 The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content...
CVE-2026-106033 Cross-Site Scripting (XSS) in Ansible Platform UI (CVE-2026-106033)
CVE-2026-104073 Cross-Site Scripting (XSS) in NetBox (CVE-2026-104073)
CVE-2026-106107 Cross-Site Scripting (XSS) in @quasar/app-vite (CVE-2026-106107)
CVE-2026-106106 Cross-Site Scripting (XSS) in @quasar/render-ssr-error (CVE-2026-106106)
CVE-2026-106102 Cross-Site Scripting (XSS) in quasar (CVE-2026-106102)
CVE-2026-105862 Cross-Site Scripting (XSS) in payload (CVE-2026-105862)
CVE-2026-105950 Cross-Site Scripting (XSS) in getformwork formwork (CVE-2026-105950)
CVE-2026-105798 Cross-Site Scripting (XSS) in SimpleChat (CVE-2026-105798)
CVE-2026-12380 Cross-Site Scripting (XSS) in E-Commerce Pack (CVE-2026-12380)
CVE-2025-15591 Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management Content Server...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details