Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 4.8 Cross-Site Scripting (XSS) in Datactive Cross-site scripting in Datactive (CVE-2025-13505). Risk of unauthorized operations or information disclosure. CVE-2025-13505 Dec 3, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Nexter Extension – Site Enhancements Toolkit (WordPress plugin) Cross-site scripting in Nexter Extension – Site Enhancements Toolkit (WordPress plugin) (CVE-2025-13731). Risk of unauthorized operations or information disclosure. CVE-2025-13731 Dec 2, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Idieikon Cross-site scripting in Idieikon (CVE-2025-40700). Risk of unauthorized operations or information disclosure. CVE-2025-40700 Dec 2, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Objectplanet Cross-site scripting in Objectplanet (CVE-2025-13873). Risk of unauthorized operations or information disclosure. CVE-2025-13873 Dec 2, 2025
Medium 6.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13007). Risk of unauthorized operations or information disclosure. CVE-2025-13007 Dec 2, 2025
High 7.2 Cross-Site Scripting (XSS) in Kadence WooCommerce Email Designer (WordPress plugin) Cross-site scripting in Kadence WooCommerce Email Designer (WordPress plugin) (CVE-2025-13387). Risk of unauthorized operations or information disclosure. CVE-2025-13387 Dec 2, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13697). Risk of unauthorized operations or information disclosure. CVE-2025-13697 Dec 2, 2025
Medium 5.4 Cross-Site Scripting (XSS) in @angular/compiler Cross-site scripting in @angular/compiler (CVE-2025-66412). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 21.0.2 or later. CVE-2025-66412 Dec 2, 2025
Medium 4.6 Cross-Site Scripting (XSS) in FileRise Cross-site scripting in FileRise (CVE-2025-66403). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.2.3 or later. CVE-2025-66403 Dec 2, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Getgrav Cross-site scripting in Getgrav (CVE-2025-66311). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.11.0-beta.1 or later. CVE-2025-66311 Dec 2, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Getgrav Cross-site scripting in Getgrav (CVE-2025-66312). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.11.0-beta.1 or later. CVE-2025-66312 Dec 2, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Snipe-IT Cross-site scripting in Snipe-IT (CVE-2025-65622). Risk of unauthorized operations or information disclosure. CVE-2025-65622 Dec 2, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Snipe-IT Cross-site scripting in Snipe-IT (CVE-2025-65621). Risk of unauthorized operations or information disclosure. CVE-2025-65621 Dec 2, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Arconix Shortcodes Cross-site scripting in Arconix Shortcodes (CVE-2025-13835). Risk of unauthorized operations or information disclosure. CVE-2025-13835 Dec 2, 2025
Unrated Cross-Site Scripting (XSS) in Sanoma's Clickedu Cross-site scripting in Sanoma's Clickedu (CVE-2025-41070). Risk of unauthorized operations or information disclosure. CVE-2025-41070 Dec 1, 2025
Medium 4.3 Cross-Site Scripting (XSS) in jairiidriss RestaurantWebsite Cross-site scripting in jairiidriss RestaurantWebsite (CVE-2025-13802). Risk of unauthorized operations or information disclosure. CVE-2025-13802 Dec 1, 2025
Low 2.4 Cross-Site Scripting (XSS) in codingWithElias School Management System Cross-site scripting in codingWithElias School Management System (CVE-2025-13795). Risk of unauthorized operations or information disclosure. CVE-2025-13795 Dec 1, 2025
Medium 4.3 Cross-Site Scripting (XSS) in winston-dsouza Ecommerce-Website Cross-site scripting in winston-dsouza Ecommerce-Website (CVE-2025-13793). Risk of unauthorized operations or information disclosure. CVE-2025-13793 Dec 1, 2025
Low 2.4 Cross-Site Scripting (XSS) in yungifez Skuul School Management System Cross-site scripting in yungifez Skuul School Management System (CVE-2025-13784). Risk of unauthorized operations or information disclosure. CVE-2025-13784 Nov 30, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Tryton sao Cross-site scripting in Tryton sao (CVE-2025-66421). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 7.6.11 or later. CVE-2025-66421 Nov 30, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Tryton sao Cross-site scripting in Tryton sao (CVE-2025-66420). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 7.6.9 or later. CVE-2025-66420 Nov 30, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Retro Cross-site scripting in Retro (CVE-2025-66036). Risk of unauthorized operations or information disclosure. CVE-2025-66036 Nov 29, 2025
High 8.5 Cross-Site Scripting (XSS) in Logpoint Cross-site scripting in Logpoint (CVE-2025-66359). Successful exploitation can lead to full system takeover. CVE-2025-66359 Nov 28, 2025
Exploited High Cross-Site Scripting (XSS) in OpenPLC ScadaBR Cross-site scripting in OpenPLC ScadaBR (CVE-2021-26829). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. CVE-2021-26829 Nov 28, 2025
High 7.2 Cross-Site Scripting (XSS) in Unlimited Elements For Elementor (WordPress plugin) Cross-site scripting in Unlimited Elements For Elementor (WordPress plugin) (CVE-2025-13692). Risk of unauthorized operations or information disclosure. CVE-2025-13692 Nov 27, 2025
Medium 5.4 Malicious content uploaded as file can be used to execute script code when following attacker-controlled links… Cross-site scripting reported (CVE-2025-59026). Risk of unauthorized operations or information disclosure. CVE-2025-59026 Nov 27, 2025
Medium 6.1 Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the… Cross-site scripting reported (CVE-2025-59025). Risk of unauthorized operations or information disclosure. CVE-2025-59025 Nov 27, 2025
Medium 5.4 Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can… Cross-site scripting reported (CVE-2025-30190). Risk of unauthorized operations or information disclosure. CVE-2025-30190 Nov 27, 2025
Medium 5.4 Malicious content uploaded as file can be used to execute script code when following attacker-controlled links… Cross-site scripting reported (CVE-2025-30186). Risk of unauthorized operations or information disclosure. CVE-2025-30186 Nov 27, 2025
Medium 4.4 Cross-Site Scripting (XSS) in StaffList (WordPress plugin) Cross-site scripting in StaffList (WordPress plugin) (CVE-2025-12185). Risk of unauthorized operations or information disclosure. CVE-2025-12185 Nov 27, 2025