Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 5.4 Cross-Site Scripting (XSS) in PDF Catalog for WooCommerce (WordPress plugin) Cross-site scripting in PDF Catalog for WooCommerce (WordPress plugin) (CVE-2025-12191). Risk of unauthorized operations or information disclosure. CVE-2025-12191 Dec 5, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Omnipress (WordPress plugin) Cross-site scripting in Omnipress (WordPress plugin) (CVE-2025-12163). Risk of unauthorized operations or information disclosure. CVE-2025-12163 Dec 5, 2025
Medium 4.4 Cross-Site Scripting (XSS) in FitVids for (WordPress plugin) Cross-site scripting in FitVids for (WordPress plugin) (CVE-2025-12124). Risk of unauthorized operations or information disclosure. CVE-2025-12124 Dec 5, 2025
Medium 6.4 Cross-Site Scripting (XSS) in SurveyFunnel – Survey Plugin for (WordPress plugin) Cross-site scripting in SurveyFunnel – Survey Plugin for (WordPress plugin) (CVE-2025-12417). Risk of unauthorized operations or information disclosure. CVE-2025-12417 Dec 5, 2025
Medium 4.8 Cross-Site Scripting (XSS) in Watchguard Firebox Cross-site scripting in Watchguard Firebox (CVE-2025-6946). Risk of unauthorized operations or information disclosure. CVE-2025-6946 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Monkeytype is a minimalistic Cross-site scripting in Monkeytype is a minimalistic (CVE-2025-66563). Risk of unauthorized operations or information disclosure. CVE-2025-66563 Dec 5, 2025
High 7.3 Cross-Site Scripting (XSS) in SysReptor Cross-site scripting in SysReptor (CVE-2025-66561). Confidential information can be exposed externally. Mitigation: upgrade to 2025.102 or later. CVE-2025-66561 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in WatchGuard Fireware OS Cross-site scripting in WatchGuard Fireware OS (CVE-2025-13939). Risk of unauthorized operations or information disclosure. CVE-2025-13939 Dec 5, 2025
Medium 5.4 Cross-Site Scripting (XSS) in TranzAxis Cross-site scripting in TranzAxis (CVE-2025-66574). Risk of unauthorized operations or information disclosure. CVE-2025-66574 Dec 5, 2025
High 8.7 Cross-Site Scripting (XSS) in Open WebUI Cross-site scripting in Open WebUI (CVE-2025-65959). Confidential information can be exposed externally. Mitigation: upgrade to 0.6.37 or later. CVE-2025-65959 Dec 5, 2025
Unrated Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded… Cross-site scripting reported (CVE-2025-13488). Risk of unauthorized operations or information disclosure. CVE-2025-13488 Dec 5, 2025
Low 2.4 Cross-Site Scripting (XSS) in JIZHICMS Cross-site scripting in JIZHICMS (CVE-2025-14013). Risk of unauthorized operations or information disclosure. CVE-2025-14013 Dec 5, 2025
Low 3.5 Cross-Site Scripting (XSS) in dayrui XunRuiCMS Cross-site scripting in dayrui XunRuiCMS (CVE-2025-14006). Risk of unauthorized operations or information disclosure. CVE-2025-14006 Dec 5, 2025
Low 2.0 Cross-Site Scripting (XSS) in dayrui XunRuiCMS Cross-site scripting in dayrui XunRuiCMS (CVE-2025-14007). Risk of unauthorized operations or information disclosure. CVE-2025-14007 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Seafile Cross-site scripting in Seafile (CVE-2025-41080). Risk of unauthorized operations or information disclosure. CVE-2025-41080 Dec 4, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Seafile Cross-site scripting in Seafile (CVE-2025-41079). Risk of unauthorized operations or information disclosure. CVE-2025-41079 Dec 4, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Clik stats (WordPress plugin) Cross-site scripting in Clik stats (WordPress plugin) (CVE-2025-13513). Risk of unauthorized operations or information disclosure. CVE-2025-13513 Dec 4, 2025
High 7.2 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-11727). Risk of unauthorized operations or information disclosure. CVE-2025-11727 Dec 4, 2025
Medium 6.4 Vulnerability in Nextcloud CVE-2025-59788 Dec 4, 2025
High 7.6 Cross-Site Scripting (XSS) in Rommapp Cross-site scripting in Rommapp (CVE-2025-65027). Data can be tampered with by attackers. Mitigation: upgrade to 4.4.1 or later. CVE-2025-65027 Dec 4, 2025
Medium 5.5 Cross-Site Scripting (XSS) in HCL Technologies Limited HCLTech DRAGON Cross-site scripting in HCL Technologies Limited HCLTech DRAGON (CVE-2025-63401). Data can be tampered with by attackers. CVE-2025-63401 Dec 4, 2025
Critical 9.6 Code Injection in Mermaid diagram renderer CVE-2025-66222 Dec 4, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Avtech Cross-site scripting in Avtech (CVE-2025-57202). Risk of unauthorized operations or information disclosure. CVE-2025-57202 Dec 4, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Autoptimize (WordPress plugin) Cross-site scripting in Autoptimize (WordPress plugin) (CVE-2025-13401). Risk of unauthorized operations or information disclosure. CVE-2025-13401 Dec 3, 2025
Medium 6.4 Cross-Site Scripting (XSS) in CSSIgniter Shortcodes (WordPress plugin) Cross-site scripting in CSSIgniter Shortcodes (WordPress plugin) (CVE-2025-13448). Risk of unauthorized operations or information disclosure. CVE-2025-13448 Dec 3, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-66459). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.35.3 or later. CVE-2025-66459 Dec 3, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-66460). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.35.3 or later. CVE-2025-66460 Dec 3, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-66458). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.35.3 or later. CVE-2025-66458 Dec 3, 2025
High 8.1 Cross-Site Scripting (XSS) in Google Chrome Cross-site scripting in Google Chrome (CVE-2025-13639). Confidential information can be exposed externally. CVE-2025-13639 Dec 3, 2025
High 7.6 Cross-Site Scripting (XSS) in Aimeos Cross-site scripting in Aimeos (CVE-2025-66468). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 2021.10.8 or later. CVE-2025-66468 Dec 3, 2025