Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.1 Cross-Site Scripting (XSS) in WP Directory Kit (WordPress plugin) Cross-site scripting in WP Directory Kit (WordPress plugin) (CVE-2025-13525). Risk of unauthorized operations or information disclosure. CVE-2025-13525 Nov 27, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Customer Reviews Collector for WooCommerce (WordPress plugin) Cross-site scripting in Customer Reviews Collector for WooCommerce (WordPress plugin) (CVE-2025-12123). Risk of unauthorized operations or information disclosure. CVE-2025-12123 Nov 27, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Simple Folio (WordPress plugin) Cross-site scripting in Simple Folio (WordPress plugin) (CVE-2025-12151). Risk of unauthorized operations or information disclosure. CVE-2025-12151 Nov 27, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Shouty (WordPress plugin) Cross-site scripting in Shouty (WordPress plugin) (CVE-2025-12712). Risk of unauthorized operations or information disclosure. CVE-2025-12712 Nov 27, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Soundslides (WordPress plugin) Cross-site scripting in Soundslides (WordPress plugin) (CVE-2025-12713). Risk of unauthorized operations or information disclosure. CVE-2025-12713 Nov 27, 2025
Medium 6.4 Cross-Site Scripting (XSS) in SortTable Post (WordPress plugin) Cross-site scripting in SortTable Post (WordPress plugin) (CVE-2025-12649). Risk of unauthorized operations or information disclosure. CVE-2025-12649 Nov 27, 2025
Medium 6.4 Cross-Site Scripting (XSS) in wp-twitpic (WordPress plugin) Cross-site scripting in wp-twitpic (WordPress plugin) (CVE-2025-12670). Risk of unauthorized operations or information disclosure. CVE-2025-12670 Nov 27, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Google Drive upload and download link (WordPress plugin) Cross-site scripting in Google Drive upload and download link (WordPress plugin) (CVE-2025-12666). Risk of unauthorized operations or information disclosure. CVE-2025-12666 Nov 27, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Classroomio LMS Cross-site scripting in Classroomio LMS (CVE-2025-65675). Risk of unauthorized operations or information disclosure. CVE-2025-65675 Nov 27, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Classroomio LMS Cross-site scripting in Classroomio LMS (CVE-2025-65676). Risk of unauthorized operations or information disclosure. CVE-2025-65676 Nov 27, 2025
Critical 9.8 Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to… Cross-site scripting reported (CVE-2025-64130). Successful exploitation can lead to full system takeover. CVE-2025-64130 Nov 27, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Houzez (WordPress theme) Cross-site scripting in Houzez (WordPress theme) (CVE-2025-9163). Risk of unauthorized operations or information disclosure. CVE-2025-9163 Nov 26, 2025
Medium 6.1 Cross-Site Scripting (XSS) in REDAXO Cross-site scripting in REDAXO (CVE-2025-66026). Risk of unauthorized operations or information disclosure. CVE-2025-66026 Nov 26, 2025
Medium 6.1 Cross-Site Scripting (XSS) in OWASP Java HTML Sanitizer Cross-site scripting in OWASP Java HTML Sanitizer (CVE-2025-66021). Risk of unauthorized operations or information disclosure. CVE-2025-66021 Nov 26, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Formwork Cross-site scripting in Formwork (CVE-2025-65956). Risk of unauthorized operations or information disclosure. CVE-2025-65956 Nov 26, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Geoserver Cross-site scripting in Geoserver (CVE-2025-21621). Risk of unauthorized operations or information disclosure. CVE-2025-21621 Nov 26, 2025
Low 3.3 Vulnerability in Contao CVE-2025-65961 Nov 26, 2025
High 7.9 A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation… Cross-site scripting reported (CVE-2025-40890). Data can be tampered with by attackers. CVE-2025-40890 Nov 26, 2025
High 8.1 HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of… Vulnerability reported (CVE-2025-0248). Confidential information can be exposed externally. CVE-2025-0248 Nov 26, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Job Board by BestWebSoft (WordPress plugin) Cross-site scripting in Job Board by BestWebSoft (WordPress plugin) (CVE-2025-13383). Risk of unauthorized operations or information disclosure. CVE-2025-13383 Nov 25, 2025
Medium 4.4 Cross-Site Scripting (XSS) in Just Highlight (WordPress plugin) Cross-site scripting in Just Highlight (WordPress plugin) (CVE-2025-13311). Risk of unauthorized operations or information disclosure. CVE-2025-13311 Nov 25, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Inline frame – Iframe (WordPress plugin) Cross-site scripting in Inline frame – Iframe (WordPress plugin) (CVE-2025-12645). Risk of unauthorized operations or information disclosure. CVE-2025-12645 Nov 25, 2025
Medium 4.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12032). Risk of unauthorized operations or information disclosure. CVE-2025-12032 Nov 25, 2025
Medium 4.4 Cross-Site Scripting (XSS) in YouTube Subscribe (WordPress plugin) Cross-site scripting in YouTube Subscribe (WordPress plugin) (CVE-2025-12025). Risk of unauthorized operations or information disclosure. CVE-2025-12025 Nov 25, 2025
Medium 6.1 Cross-Site Scripting (XSS) in SNC-CX600W all Cross-site scripting in SNC-CX600W all (CVE-2025-64730). Risk of unauthorized operations or information disclosure. CVE-2025-64730 Nov 25, 2025
High 7.2 Cross-Site Scripting (XSS) in Telegram Bot & Channel (WordPress plugin) Cross-site scripting in Telegram Bot & Channel (WordPress plugin) (CVE-2025-13068). Risk of unauthorized operations or information disclosure. CVE-2025-13068 Nov 25, 2025
Medium 6.1 Cross-Site Scripting (XSS) in OpenRapid RapidCMS Cross-site scripting in OpenRapid RapidCMS (CVE-2025-64047). Risk of unauthorized operations or information disclosure. CVE-2025-64047 Nov 25, 2025
Medium 6.1 Cross-Site Scripting (XSS) in YCCMS Cross-site scripting in YCCMS (CVE-2025-64048). Risk of unauthorized operations or information disclosure. CVE-2025-64048 Nov 25, 2025
High 8.7 A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer… Cross-site scripting reported (CVE-2025-10555). Confidential information can be exposed externally. CVE-2025-10555 Nov 25, 2025
High 8.7 Cross-Site Scripting (XSS) in 3Ds Cross-site scripting in 3Ds (CVE-2025-10554). Confidential information can be exposed externally. CVE-2025-10554 Nov 25, 2025