Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Unrated Cross-Site Scripting (XSS) in SVG Cross-site scripting in SVG (CVE-2025-41087). Risk of unauthorized operations or information disclosure. CVE-2025-41087 Nov 24, 2025
Unrated An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would… Cross-site scripting reported (CVE-2025-12739). Risk of unauthorized operations or information disclosure. CVE-2025-12739 Nov 24, 2025
Low 3.5 Cross-Site Scripting (XSS) in Eigenfocus Cross-site scripting in Eigenfocus (CVE-2025-13584). Risk of unauthorized operations or information disclosure. CVE-2025-13584 Nov 24, 2025
Unrated FMS developed by Otsuka Information Technology has a Reflected Cross-site Scripting vulnerability, allowing… Cross-site scripting reported (CVE-2025-13589). Risk of unauthorized operations or information disclosure. CVE-2025-13589 Nov 24, 2025
Low 3.5 Cross-Site Scripting (XSS) in PHPGurukul Hostel Management System Cross-site scripting in PHPGurukul Hostel Management System (CVE-2025-13577). Risk of unauthorized operations or information disclosure. CVE-2025-13577 Nov 24, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Cookie Notice & Compliance for GDPR / CCPA (WordPress plugin) Cross-site scripting in Cookie Notice & Compliance for GDPR / CCPA (WordPress plugin) (CVE-2025-11186). Risk of unauthorized operations or information disclosure. CVE-2025-11186 Nov 22, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Nelio Popups Cross-site scripting in Nelio Popups (CVE-2025-66111). Risk of unauthorized operations or information disclosure. CVE-2025-66111 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Travelers' Map Cross-site scripting in Travelers' Map (CVE-2025-66098). Risk of unauthorized operations or information disclosure. CVE-2025-66098 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Extensions for Leaflet Map Cross-site scripting in Extensions for Leaflet Map (CVE-2025-66093). Risk of unauthorized operations or information disclosure. CVE-2025-66093 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in SKT Skill Bar Cross-site scripting in SKT Skill Bar (CVE-2025-66090). Risk of unauthorized operations or information disclosure. CVE-2025-66090 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Stylish Cost Calculator Cross-site scripting in Stylish Cost Calculator (CVE-2025-66091). Risk of unauthorized operations or information disclosure. CVE-2025-66091 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Accordion Slider Cross-site scripting in Accordion Slider (CVE-2025-66092). Risk of unauthorized operations or information disclosure. CVE-2025-66092 Nov 21, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Head Meta Data Cross-site scripting in Head Meta Data (CVE-2025-66081). Risk of unauthorized operations or information disclosure. CVE-2025-66081 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Envo Extra Cross-site scripting in Envo Extra (CVE-2025-66066). Risk of unauthorized operations or information disclosure. CVE-2025-66066 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Funnel Builder by FunnelKit Cross-site scripting in Funnel Builder by FunnelKit (CVE-2025-66067). Risk of unauthorized operations or information disclosure. CVE-2025-66067 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Enfold Cross-site scripting in Enfold (CVE-2025-66053). Risk of unauthorized operations or information disclosure. CVE-2025-66053 Nov 21, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Bold Page Builder Cross-site scripting in Bold Page Builder (CVE-2025-66057). Risk of unauthorized operations or information disclosure. CVE-2025-66057 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12935). Risk of unauthorized operations or information disclosure. CVE-2025-12935 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Magical Products Display (WordPress plugin) Cross-site scripting in Magical Products Display (WordPress plugin) (CVE-2025-12964). Risk of unauthorized operations or information disclosure. CVE-2025-12964 Nov 21, 2025
High 7.2 Cross-Site Scripting (XSS) in Simple User Registration (WordPress plugin) Cross-site scripting in Simple User Registration (WordPress plugin) (CVE-2025-12160). Risk of unauthorized operations or information disclosure. CVE-2025-12160 Nov 21, 2025
Medium 4.4 Cross-Site Scripting (XSS) in WP Delete Post Copies (WordPress plugin) Cross-site scripting in WP Delete Post Copies (WordPress plugin) (CVE-2025-12066). Risk of unauthorized operations or information disclosure. CVE-2025-12066 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WP Company Info (WordPress plugin) Cross-site scripting in WP Company Info (WordPress plugin) (CVE-2025-11826). Risk of unauthorized operations or information disclosure. CVE-2025-11826 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in HT Mega – Absolute Addons For Elementor (WordPress plugin) Cross-site scripting in HT Mega – Absolute Addons For Elementor (WordPress plugin) (CVE-2025-13141). Risk of unauthorized operations or information disclosure. CVE-2025-13141 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WPSite Shortcode (WordPress plugin) Cross-site scripting in WPSite Shortcode (WordPress plugin) (CVE-2025-11803). Risk of unauthorized operations or information disclosure. CVE-2025-11803 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Shortcode for Google Street View (WordPress plugin) Cross-site scripting in Shortcode for Google Street View (WordPress plugin) (CVE-2025-11808). Risk of unauthorized operations or information disclosure. CVE-2025-11808 Nov 21, 2025
High 7.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13159). Risk of unauthorized operations or information disclosure. Exploitable via flo_form_submit. CVE-2025-13159 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in HotelRunner Booking Widget (WordPress plugin) Cross-site scripting in HotelRunner Booking Widget (WordPress plugin) (CVE-2025-13135). Risk of unauthorized operations or information disclosure. CVE-2025-13135 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Padlet Shortcode (WordPress plugin) Cross-site scripting in Padlet Shortcode (WordPress plugin) (CVE-2025-12660). Risk of unauthorized operations or information disclosure. CVE-2025-12660 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12661). Risk of unauthorized operations or information disclosure. CVE-2025-12661 Nov 21, 2025
High 7.2 Cross-Site Scripting (XSS) in WPBookit (WordPress plugin) Cross-site scripting in WPBookit (WordPress plugin) (CVE-2025-12135). Risk of unauthorized operations or information disclosure. CVE-2025-12135 Nov 21, 2025