Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Critical 9.6 Cross-Site Scripting (XSS) in Ivanti Endpoint Manager Cross-site scripting in Ivanti Endpoint Manager (CVE-2025-10573). Successful exploitation can lead to full system takeover. CVE-2025-10573 Dec 10, 2025
Critical 9.6 Cross-Site Scripting (XSS) in DeepChat Cross-site scripting in DeepChat (CVE-2025-66481). Successful exploitation can lead to full system takeover. CVE-2025-66481 Dec 9, 2025
Medium 5.4 Cross-Site Scripting (XSS) in IBM WebSphere Application Server Cross-site scripting in IBM WebSphere Application Server (CVE-2025-12635). Risk of unauthorized operations or information disclosure. CVE-2025-12635 Dec 9, 2025
Low 3.5 Cross-Site Scripting (XSS) in R.V.R Cross-site scripting in R.V.R (CVE-2025-65228). Risk of unauthorized operations or information disclosure. CVE-2025-65228 Dec 9, 2025
Medium 4.6 Cross-Site Scripting (XSS) in Lyrion Music Server Cross-site scripting in Lyrion Music Server (CVE-2025-65229). Risk of unauthorized operations or information disclosure. CVE-2025-65229 Dec 9, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Barix Instreamer Cross-site scripting in Barix Instreamer (CVE-2025-65230). Risk of unauthorized operations or information disclosure. CVE-2025-65230 Dec 9, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Barix Instreamer Cross-site scripting in Barix Instreamer (CVE-2025-65231). Risk of unauthorized operations or information disclosure. CVE-2025-65231 Dec 9, 2025
Unrated In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way… Cross-site scripting reported (CVE-2025-42620). Risk of unauthorized operations or information disclosure. CVE-2025-42620 Dec 8, 2025
Low 2.4 Cross-Site Scripting (XSS) in GreenCMS Cross-site scripting in GreenCMS (CVE-2025-14244). Risk of unauthorized operations or information disclosure. CVE-2025-14244 Dec 8, 2025
Low 3.5 Cross-Site Scripting (XSS) in Yealink SIP-T21P E2 Cross-site scripting in Yealink SIP-T21P E2 (CVE-2025-14228). Risk of unauthorized operations or information disclosure. CVE-2025-14228 Dec 8, 2025
High 8.7 Cross-Site Scripting (XSS) in 3Ds Cross-site scripting in 3Ds (CVE-2025-12956). Confidential information can be exposed externally. CVE-2025-12956 Dec 8, 2025
Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Online Banking System Cross-site scripting in SourceCodester Online Banking System (CVE-2025-14221). Risk of unauthorized operations or information disclosure. CVE-2025-14221 Dec 8, 2025
Low 2.4 Cross-Site Scripting (XSS) in Commerce Membership Management System Cross-site scripting in Commerce Membership Management System (CVE-2025-14205). Risk of unauthorized operations or information disclosure. CVE-2025-14205 Dec 8, 2025
Low 2.4 Cross-Site Scripting (XSS) in alokjaiswal Hotel-Management-services-using-MYSQL-and-php Cross-site scripting in alokjaiswal Hotel-Management-services-using-MYSQL-and-php (CVE-2025-14201). Risk of unauthorized operations or information disclosure. CVE-2025-14201 Dec 8, 2025
Low 3.5 Cross-Site Scripting (XSS) in alokjaiswal Hotel-Management-services-using-MYSQL-and-php Cross-site scripting in alokjaiswal Hotel-Management-services-using-MYSQL-and-php (CVE-2025-14200). Risk of unauthorized operations or information disclosure. CVE-2025-14200 Dec 8, 2025
Low 3.5 Cross-Site Scripting (XSS) in code-projects Employee Profile Management System Cross-site scripting in code-projects Employee Profile Management System (CVE-2025-14194). Risk of unauthorized operations or information disclosure. CVE-2025-14194 Dec 8, 2025
High 7.2 Cross-Site Scripting (XSS) in Rich Shortcodes for Google Reviews (WordPress plugin) Cross-site scripting in Rich Shortcodes for Google Reviews (WordPress plugin) (CVE-2025-12499). Risk of unauthorized operations or information disclosure. CVE-2025-12499 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in TR Timthumb (WordPress plugin) Cross-site scripting in TR Timthumb (WordPress plugin) (CVE-2025-13899). Risk of unauthorized operations or information disclosure. CVE-2025-13899 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Social Feed Gallery Portfolio (WordPress plugin) Cross-site scripting in Social Feed Gallery Portfolio (WordPress plugin) (CVE-2025-13896). Risk of unauthorized operations or information disclosure. CVE-2025-13896 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Ultra Skype Button (WordPress plugin) Cross-site scripting in Ultra Skype Button (WordPress plugin) (CVE-2025-13898). Risk of unauthorized operations or information disclosure. CVE-2025-13898 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in CSS3 Buttons (WordPress plugin) Cross-site scripting in CSS3 Buttons (WordPress plugin) (CVE-2025-13907). Risk of unauthorized operations or information disclosure. CVE-2025-13907 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in RevInsite (WordPress plugin) Cross-site scripting in RevInsite (WordPress plugin) (CVE-2025-13863). Risk of unauthorized operations or information disclosure. Exploitable via token. CVE-2025-13863 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Extra Post Images (WordPress plugin) Cross-site scripting in Extra Post Images (WordPress plugin) (CVE-2025-13856). Risk of unauthorized operations or information disclosure. CVE-2025-13856 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Cute News Ticker (WordPress plugin) Cross-site scripting in Cute News Ticker (WordPress plugin) (CVE-2025-13656). Risk of unauthorized operations or information disclosure. CVE-2025-13656 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Yet Another WebClap for (WordPress plugin) Cross-site scripting in Yet Another WebClap for (WordPress plugin) (CVE-2025-13857). Risk of unauthorized operations or information disclosure. CVE-2025-13857 Dec 6, 2025
Medium 6.1 Cross-Site Scripting (XSS) in CSV Sumotto (WordPress plugin) Cross-site scripting in CSV Sumotto (WordPress plugin) (CVE-2025-13894). Risk of unauthorized operations or information disclosure. CVE-2025-13894 Dec 6, 2025
Medium 6.1 Cross-Site Scripting (XSS) in myLCO (WordPress plugin) Cross-site scripting in myLCO (WordPress plugin) (CVE-2025-13626). Risk of unauthorized operations or information disclosure. CVE-2025-13626 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Application Passwords (WordPress plugin) Cross-site scripting in Application Passwords (WordPress plugin) (CVE-2025-13308). Risk of unauthorized operations or information disclosure. CVE-2025-13308 Dec 6, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Live Sales Notification for Woocommerce – Woomotiv (WordPress plugin) Cross-site scripting in Live Sales Notification for Woocommerce – Woomotiv (WordPress plugin) (CVE-2025-13137). Risk of unauthorized operations or information disclosure. CVE-2025-13137 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in List Attachments Shortcode (WordPress plugin) Cross-site scripting in List Attachments Shortcode (WordPress plugin) (CVE-2025-12717). Risk of unauthorized operations or information disclosure. CVE-2025-12717 Dec 6, 2025