Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.4 Cross-Site Scripting (XSS) in RTMKit Addons for Elementor (WordPress plugin) Cross-site scripting in RTMKit Addons for Elementor (WordPress plugin) (CVE-2025-8609). Risk of unauthorized operations or information disclosure. CVE-2025-8609 Nov 18, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-8605). Risk of unauthorized operations or information disclosure. CVE-2025-8605 Nov 18, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Solarwinds Observability Self Hosted Cross-site scripting in Solarwinds Observability Self Hosted (CVE-2025-26391). Risk of unauthorized operations or information disclosure. CVE-2025-26391 Nov 18, 2025
Medium 6.4 Cross-Site Scripting (XSS) in CSV to SortTable (WordPress plugin) Cross-site scripting in CSV to SortTable (WordPress plugin) (CVE-2025-12823). Risk of unauthorized operations or information disclosure. CVE-2025-12823 Nov 18, 2025
Medium 6.1 Cross-Site Scripting (XSS) in ArtiBot Free Chat Bot for WebSites (WordPress plugin) Cross-site scripting in ArtiBot Free Chat Bot for WebSites (WordPress plugin) (CVE-2025-12078). Risk of unauthorized operations or information disclosure. CVE-2025-12078 Nov 18, 2025
Medium 6.4 Cross-Site Scripting (XSS) in everviz (WordPress plugin) Cross-site scripting in everviz (WordPress plugin) (CVE-2025-11868). Risk of unauthorized operations or information disclosure. Exploitable via everviz. CVE-2025-11868 Nov 18, 2025
Medium 4.8 Cross-Site Scripting (XSS) in Maxum Cross-site scripting in Maxum (CVE-2025-55056). Risk of unauthorized operations or information disclosure. CVE-2025-55056 Nov 18, 2025
Medium 4.8 Cross-Site Scripting (XSS) in Maxum Cross-site scripting in Maxum (CVE-2025-55059). Risk of unauthorized operations or information disclosure. CVE-2025-55059 Nov 18, 2025
Medium 4.8 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message Cross-site scripting reported (CVE-2025-64758). Risk of unauthorized operations or information disclosure. CVE-2025-64758 Nov 18, 2025
Medium 6.1 Cross-Site Scripting (XSS) in OpenRapid RapidCMS Cross-site scripting in OpenRapid RapidCMS (CVE-2025-64046). Risk of unauthorized operations or information disclosure. CVE-2025-64046 Nov 18, 2025
Medium 5.7 Cross-Site Scripting (XSS) in Mendix RichText Cross-site scripting in Mendix RichText (CVE-2025-40834). Confidential information can be exposed externally. CVE-2025-40834 Nov 17, 2025
Low 3.5 Cross-Site Scripting (XSS) in code-projects Student Information System Cross-site scripting in code-projects Student Information System (CVE-2025-13245). Risk of unauthorized operations or information disclosure. CVE-2025-13245 Nov 16, 2025
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Student Information System Cross-site scripting in code-projects Student Information System (CVE-2025-13244). Risk of unauthorized operations or information disclosure. CVE-2025-13244 Nov 16, 2025
Low 3.5 Cross-Site Scripting (XSS) in code-projects Simple Cafe Ordering System Cross-site scripting in code-projects Simple Cafe Ordering System (CVE-2025-13202). Risk of unauthorized operations or information disclosure. CVE-2025-13202 Nov 16, 2025
Low 2.4 Cross-Site Scripting (XSS) in Bdtask Cross-site scripting in Bdtask (CVE-2025-13186). Risk of unauthorized operations or information disclosure. CVE-2025-13186 Nov 15, 2025
Low 3.5 Cross-Site Scripting (XSS) in pojoin h3blog Cross-site scripting in pojoin h3blog (CVE-2025-13182). Risk of unauthorized operations or information disclosure. CVE-2025-13182 Nov 15, 2025
Low 3.5 Cross-Site Scripting (XSS) in pojoin h3blog Cross-site scripting in pojoin h3blog (CVE-2025-13181). Risk of unauthorized operations or information disclosure. CVE-2025-13181 Nov 15, 2025
Low 3.5 Vulnerability in Bdtask CVE-2025-13180 Nov 15, 2025
Low 3.5 Vulnerability in Bdtask/CodeCanyon SalesERP CVE-2025-13178 Nov 15, 2025
Medium 4.8 Cross-Site Scripting (XSS) in QuickCMS Cross-site scripting in QuickCMS (CVE-2025-10018). Risk of unauthorized operations or information disclosure. CVE-2025-10018 Nov 14, 2025
High 7.2 Cross-Site Scripting (XSS) in SNORDIAN's H5PxAPIkatchu (WordPress plugin) Cross-site scripting in SNORDIAN's H5PxAPIkatchu (WordPress plugin) (CVE-2025-12904). Risk of unauthorized operations or information disclosure. CVE-2025-12904 Nov 14, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Google Chrome Cross-site scripting in Google Chrome (CVE-2025-13097). Risk of unauthorized operations or information disclosure. CVE-2025-13097 Nov 14, 2025
High 8.1 Cross-Site Scripting (XSS) in vega Cross-site scripting in vega (CVE-2025-59840). Confidential information can be exposed externally. Exploitable via vega. Mitigation: upgrade to 6.2.0 or later. CVE-2025-59840 Nov 14, 2025
Medium 5.5 Vulnerability in Monospace CVE-2025-64747 Nov 14, 2025
Low 3.5 Cross-Site Scripting (XSS) in OpenObserve Cross-site scripting in OpenObserve (CVE-2025-64744). Risk of unauthorized operations or information disclosure. CVE-2025-64744 Nov 14, 2025
Low 2.7 Cross-Site Scripting (XSS) in Astro Cross-site scripting in Astro (CVE-2025-64745). Risk of unauthorized operations or information disclosure. Exploitable via trailingSlash. CVE-2025-64745 Nov 14, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Cisco Catalyst Center Cross-site scripting in Cisco Catalyst Center (CVE-2025-20353). Risk of unauthorized operations or information disclosure. CVE-2025-20353 Nov 14, 2025
Medium 4.3 Cross-Site Scripting (XSS) in Zoom Cross-site scripting in Zoom (CVE-2025-62482). Risk of unauthorized operations or information disclosure. CVE-2025-62482 Nov 14, 2025
Unrated Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan… Cross-site scripting reported (CVE-2025-40681). Risk of unauthorized operations or information disclosure. CVE-2025-40681 Nov 13, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Booster for WooCommerce Cross-site scripting in Booster for WooCommerce (CVE-2025-64380). Risk of unauthorized operations or information disclosure. CVE-2025-64380 Nov 13, 2025