Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.4 Cross-Site Scripting (XSS) in Bulma Shortcodes (WordPress plugin) Cross-site scripting in Bulma Shortcodes (WordPress plugin) (CVE-2025-11802). Risk of unauthorized operations or information disclosure. CVE-2025-11802 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in AudioTube (WordPress plugin) Cross-site scripting in AudioTube (WordPress plugin) (CVE-2025-11801). Risk of unauthorized operations or information disclosure. CVE-2025-11801 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Surbma | MiniCRM Shortcode (WordPress plugin) Cross-site scripting in Surbma | MiniCRM Shortcode (WordPress plugin) (CVE-2025-11800). Risk of unauthorized operations or information disclosure. CVE-2025-11800 Nov 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in EchBay Admin Security (WordPress plugin) Cross-site scripting in EchBay Admin Security (WordPress plugin) (CVE-2025-11885). Risk of unauthorized operations or information disclosure. CVE-2025-11885 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Affiliate AI Lite (WordPress plugin) Cross-site scripting in Affiliate AI Lite (WordPress plugin) (CVE-2025-11799). Risk of unauthorized operations or information disclosure. CVE-2025-11799 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in BrightTALK WordPress Shortcode (WordPress plugin) Cross-site scripting in BrightTALK WordPress Shortcode (WordPress plugin) (CVE-2025-11770). Risk of unauthorized operations or information disclosure. CVE-2025-11770 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Shortcodes Bootstrap (WordPress plugin) Cross-site scripting in Shortcodes Bootstrap (WordPress plugin) (CVE-2025-11764). Risk of unauthorized operations or information disclosure. CVE-2025-11764 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Tips Shortcode (WordPress plugin) Cross-site scripting in Tips Shortcode (WordPress plugin) (CVE-2025-11767). Risk of unauthorized operations or information disclosure. CVE-2025-11767 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Stock Tools (WordPress plugin) Cross-site scripting in Stock Tools (WordPress plugin) (CVE-2025-11765). Risk of unauthorized operations or information disclosure. CVE-2025-11765 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Islamic Phrases (WordPress plugin) Cross-site scripting in Islamic Phrases (WordPress plugin) (CVE-2025-11768). Risk of unauthorized operations or information disclosure. CVE-2025-11768 Nov 21, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Display Pages Shortcode (WordPress plugin) Cross-site scripting in Display Pages Shortcode (WordPress plugin) (CVE-2025-11763). Risk of unauthorized operations or information disclosure. CVE-2025-11763 Nov 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Tainacan (WordPress plugin) Cross-site scripting in Tainacan (WordPress plugin) (CVE-2025-12746). Risk of unauthorized operations or information disclosure. CVE-2025-12746 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-61949). Risk of unauthorized operations or information disclosure. CVE-2025-61949 Nov 21, 2025
High 8.3 Cross-Site Scripting (XSS) in Microsoft Defender Portal Cross-site scripting in Microsoft Defender Portal (CVE-2025-62459). Confidential information can be exposed externally. CVE-2025-62459 Nov 21, 2025
Low 2.4 Cross-Site Scripting (XSS) in Campcodes Complete Online Beauty Parlor Management System Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System (CVE-2025-13484). Risk of unauthorized operations or information disclosure. CVE-2025-13484 Nov 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in IBM Concert Cross-site scripting in IBM Concert (CVE-2025-36153). Risk of unauthorized operations or information disclosure. CVE-2025-36153 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-55123). Risk of unauthorized operations or information disclosure. CVE-2025-55123 Nov 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-55124). Risk of unauthorized operations or information disclosure. CVE-2025-55124 Nov 21, 2025
Low 3.5 Cross-Site Scripting (XSS) in Medical Informatics Engineering Enterprise Health Cross-site scripting in Medical Informatics Engineering Enterprise Health (CVE-2025-35029). Risk of unauthorized operations or information disclosure. CVE-2025-35029 Nov 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-48987). Risk of unauthorized operations or information disclosure. CVE-2025-48987 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-52667). Risk of unauthorized operations or information disclosure. CVE-2025-52667 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-52668). Risk of unauthorized operations or information disclosure. CVE-2025-52668 Nov 21, 2025
Medium 4.8 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62731). Risk of unauthorized operations or information disclosure. CVE-2025-62731 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62729). Risk of unauthorized operations or information disclosure. CVE-2025-62729 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62296). Risk of unauthorized operations or information disclosure. CVE-2025-62296 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62297). Risk of unauthorized operations or information disclosure. CVE-2025-62297 Nov 21, 2025
Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62295). Risk of unauthorized operations or information disclosure. CVE-2025-62295 Nov 21, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Kaspersky Endpoint Security for Linux Cross-site scripting in Kaspersky Endpoint Security for Linux (CVE-2025-64984). Risk of unauthorized operations or information disclosure. CVE-2025-64984 Nov 21, 2025
Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Online Shop Project Cross-site scripting in SourceCodester Online Shop Project (CVE-2025-13450). Risk of unauthorized operations or information disclosure. CVE-2025-13450 Nov 21, 2025
High 7.2 Cross-Site Scripting (XSS) in Pyxis Signage Cross-site scripting in Pyxis Signage (CVE-2025-0643). Successful exploitation can lead to full system takeover. CVE-2025-0643 Nov 21, 2025