Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Low 2.4 Cross-Site Scripting (XSS) in Public Knowledge Project omp and ojs Cross-site scripting in Public Knowledge Project omp and ojs (CVE-2025-13469). Risk of unauthorized operations or information disclosure. CVE-2025-13469 Nov 20, 2025
Unrated Cross-Site Scripting (XSS) in uCMDB Cross-site scripting in uCMDB (CVE-2025-11884). Risk of unauthorized operations or information disclosure. CVE-2025-11884 Nov 20, 2025
Low 3.5 Cross-Site Scripting (XSS) in icret EasyImages Cross-site scripting in icret EasyImages (CVE-2025-13415). Risk of unauthorized operations or information disclosure. CVE-2025-13415 Nov 20, 2025
Low 2.4 Cross-Site Scripting (XSS) in Campcodes Retro Basketball Shoes Online Store Cross-site scripting in Campcodes Retro Basketball Shoes Online Store (CVE-2025-13412). Risk of unauthorized operations or information disclosure. CVE-2025-13412 Nov 20, 2025
Unrated Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-65095). Risk of unauthorized operations or information disclosure. CVE-2025-65095 Nov 20, 2025
Medium 6.1 Code Injection in esm.sh CVE-2025-65026 Nov 20, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Astro Cross-site scripting in Astro (CVE-2025-65019). Risk of unauthorized operations or information disclosure. CVE-2025-65019 Nov 20, 2025
Medium 5.4 Cross-Site Scripting (XSS) in StarCities Cross-site scripting in StarCities (CVE-2025-11963). Risk of unauthorized operations or information disclosure. CVE-2025-11963 Nov 20, 2025
High 7.2 Cross-Site Scripting (XSS) in GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin) Cross-site scripting in GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin) (CVE-2025-13206). Risk of unauthorized operations or information disclosure. CVE-2025-13206 Nov 19, 2025
High 7.2 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12484). Risk of unauthorized operations or information disclosure. CVE-2025-12484 Nov 19, 2025
Medium 6.4 Cross-Site Scripting (XSS) in FunnelKit – Funnel Builder for WooCommerce Checkout (WordPress plugin) Cross-site scripting in FunnelKit – Funnel Builder for WooCommerce Checkout (WordPress plugin) (CVE-2025-12878). Risk of unauthorized operations or information disclosure. Exploitable via wfop_phone. CVE-2025-12878 Nov 19, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13054). Risk of unauthorized operations or information disclosure. CVE-2025-13054 Nov 19, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Pet-Manager – Petfinder (WordPress plugin) Cross-site scripting in Pet-Manager – Petfinder (WordPress plugin) (CVE-2025-12710). Risk of unauthorized operations or information disclosure. CVE-2025-12710 Nov 19, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Royal Elementor Addons and Templates (WordPress plugin) Cross-site scripting in Royal Elementor Addons and Templates (WordPress plugin) (CVE-2025-6251). Risk of unauthorized operations or information disclosure. CVE-2025-6251 Nov 19, 2025
Medium 6.2 Cross-Site Scripting (XSS) in LibreNMS Cross-site scripting in LibreNMS (CVE-2025-65013). Confidential information can be exposed externally. CVE-2025-65013 Nov 19, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Kirby Cross-site scripting in Kirby (CVE-2025-65012). Risk of unauthorized operations or information disclosure. CVE-2025-65012 Nov 19, 2025
Critical 9.0 Cross-Site Scripting (XSS) in Emby Server Cross-site scripting in Emby Server (CVE-2025-64325). Successful exploitation can lead to full system takeover. CVE-2025-64325 Nov 19, 2025
Medium 6.8 Cross-Site Scripting (XSS) in SourceCodester Student Grades Management System Cross-site scripting in SourceCodester Student Grades Management System (CVE-2025-63892). Successful exploitation can lead to full system takeover. CVE-2025-63892 Nov 19, 2025
Medium 4.8 Cross-Site Scripting (XSS) in Windu CMS Cross-site scripting in Windu CMS (CVE-2025-59117). Risk of unauthorized operations or information disclosure. CVE-2025-59117 Nov 19, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Windu CMS Cross-site scripting in Windu CMS (CVE-2025-59115). Risk of unauthorized operations or information disclosure. CVE-2025-59115 Nov 19, 2025
Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Student Grades Management System Cross-site scripting in SourceCodester Student Grades Management System (CVE-2025-13349). Risk of unauthorized operations or information disclosure. CVE-2025-13349 Nov 19, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Iest Cross-site scripting in Iest (CVE-2025-41350). Risk of unauthorized operations or information disclosure. CVE-2025-41350 Nov 18, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Iest Cross-site scripting in Iest (CVE-2025-41349). Risk of unauthorized operations or information disclosure. CVE-2025-41349 Nov 18, 2025
Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Interview Management System Cross-site scripting in SourceCodester Interview Management System (CVE-2025-13343). Risk of unauthorized operations or information disclosure. CVE-2025-13343 Nov 18, 2025
High 7.2 Cross-Site Scripting (XSS) in Checkout Files Upload for WooCommerce (WordPress plugin) Cross-site scripting in Checkout Files Upload for WooCommerce (WordPress plugin) (CVE-2025-4212). Risk of unauthorized operations or information disclosure. CVE-2025-4212 Nov 18, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Element Pack Addons for Elementor (WordPress plugin) Cross-site scripting in Element Pack Addons for Elementor (WordPress plugin) (CVE-2025-13196). Risk of unauthorized operations or information disclosure. CVE-2025-13196 Nov 18, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12691). Risk of unauthorized operations or information disclosure. CVE-2025-12691 Nov 18, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Enable SVG, WebP, and ICO Upload (WordPress plugin) Cross-site scripting in Enable SVG, WebP, and ICO Upload (WordPress plugin) (CVE-2025-12457). Risk of unauthorized operations or information disclosure. CVE-2025-12457 Nov 18, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Meta Display Block (WordPress plugin) Cross-site scripting in Meta Display Block (WordPress plugin) (CVE-2025-12088). Risk of unauthorized operations or information disclosure. CVE-2025-12088 Nov 18, 2025
Medium 6.1 Cross-Site Scripting (XSS) in WP Twitter Auto Publish (WordPress plugin) Cross-site scripting in WP Twitter Auto Publish (WordPress plugin) (CVE-2025-12079). Risk of unauthorized operations or information disclosure. CVE-2025-12079 Nov 18, 2025