Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.5 Cross-Site Scripting (XSS) in Booking Calendar Cross-site scripting in Booking Calendar (CVE-2025-64381). Risk of unauthorized operations or information disclosure. CVE-2025-64381 Nov 13, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Booster for WooCommerce Cross-site scripting in Booster for WooCommerce (CVE-2025-64380). Risk of unauthorized operations or information disclosure. CVE-2025-64380 Nov 13, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Analytics Germanized for Google Analytics Cross-site scripting in Analytics Germanized for Google Analytics (CVE-2025-64292). Risk of unauthorized operations or information disclosure. CVE-2025-64292 Nov 13, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Booking Manager Cross-site scripting in Booking Manager (CVE-2025-64275). Risk of unauthorized operations or information disclosure. CVE-2025-64275 Nov 13, 2025
Medium 5.9 Cross-Site Scripting (XSS) in Popup addon for Ninja Forms Cross-site scripting in Popup addon for Ninja Forms (CVE-2025-64264). Risk of unauthorized operations or information disclosure. CVE-2025-64264 Nov 13, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Save as PDF Button (WordPress plugin) Cross-site scripting in Save as PDF Button (WordPress plugin) (CVE-2025-8397). Risk of unauthorized operations or information disclosure. CVE-2025-8397 Nov 13, 2025
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Content Flipper (WordPress plugin) Cross-site scripting in WordPress Content Flipper (WordPress plugin) (CVE-2025-11769). Risk of unauthorized operations or information disclosure. CVE-2025-11769 Nov 13, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Angel – Fashion Model Agency WordPress CMS Theme (WordPress theme) Cross-site scripting in Angel – Fashion Model Agency WordPress CMS Theme (WordPress theme) (CVE-2025-10295). Risk of unauthorized operations or information disclosure. CVE-2025-10295 Nov 13, 2025
Unrated Cross-Site Scripting (XSS) in Anubis Cross-site scripting in Anubis (CVE-2025-64716). Risk of unauthorized operations or information disclosure. CVE-2025-64716 Nov 13, 2025
Unrated Cross-Site Scripting (XSS) in WebInteropApp/WebAppInterop Cross-site scripting in WebInteropApp/WebAppInterop (CVE-2025-64710). Risk of unauthorized operations or information disclosure. CVE-2025-64710 Nov 13, 2025
Low 3.9 Cross-Site Scripting (XSS) in PrivateBin Cross-site scripting in PrivateBin (CVE-2025-64711). Risk of unauthorized operations or information disclosure. CVE-2025-64711 Nov 13, 2025
Low 3.5 Cross-Site Scripting (XSS) in soerennb eXtplorer Cross-site scripting in soerennb eXtplorer (CVE-2025-13058). Risk of unauthorized operations or information disclosure. CVE-2025-13058 Nov 13, 2025
High 7.3 Cross-Site Scripting (XSS) in Digital Corporate Warehouse Cross-site scripting in Digital Corporate Warehouse (CVE-2025-11962). Confidential information can be exposed externally. CVE-2025-11962 Nov 12, 2025
High 7.2 Cross-Site Scripting (XSS) in Easy Email Subscription (WordPress plugin) Cross-site scripting in Easy Email Subscription (WordPress plugin) (CVE-2025-11994). Risk of unauthorized operations or information disclosure. CVE-2025-11994 Nov 12, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Apache Ofbiz Cross-site scripting in Apache Ofbiz (CVE-2025-61623). Risk of unauthorized operations or information disclosure. CVE-2025-61623 Nov 12, 2025
Medium 4.8 Cross-Site Scripting (XSS) in Aenrich Cross-site scripting in Aenrich (CVE-2025-12869). Risk of unauthorized operations or information disclosure. CVE-2025-12869 Nov 12, 2025
Medium 5.4 The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote… Cross-site scripting reported (CVE-2025-12872). Risk of unauthorized operations or information disclosure. CVE-2025-12872 Nov 12, 2025
Medium 4.4 Cross-Site Scripting (XSS) in MembershipWorks – Membership, Events & Directory (WordPress plugin) Cross-site scripting in MembershipWorks – Membership, Events & Directory (WordPress plugin) (CVE-2025-12018). Risk of unauthorized operations or information disclosure. CVE-2025-12018 Nov 12, 2025
High 8.7 Cross-Site Scripting (XSS) in Dynamics 365 Field Service Cross-site scripting in Dynamics 365 Field Service (CVE-2025-62211). Confidential information can be exposed externally. CVE-2025-62211 Nov 12, 2025
High 8.7 Cross-Site Scripting (XSS) in Dynamics 365 Field Service Cross-site scripting in Dynamics 365 Field Service (CVE-2025-62210). Confidential information can be exposed externally. CVE-2025-62210 Nov 12, 2025
Unrated Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN… Cross-site scripting reported (CVE-2025-12101). Risk of unauthorized operations or information disclosure. CVE-2025-12101 Nov 11, 2025
Medium 6.5 Cross-Site Scripting (XSS) in Zohocorp ManageEngine OpManager Cross-site scripting in Zohocorp ManageEngine OpManager (CVE-2025-9227). Risk of unauthorized operations or information disclosure. CVE-2025-9227 Nov 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fairsketch Cross-site scripting in Fairsketch (CVE-2025-41106). Risk of unauthorized operations or information disclosure. CVE-2025-41106 Nov 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fairsketch Cross-site scripting in Fairsketch (CVE-2025-41104). Risk of unauthorized operations or information disclosure. CVE-2025-41104 Nov 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fairsketch Cross-site scripting in Fairsketch (CVE-2025-41105). Risk of unauthorized operations or information disclosure. CVE-2025-41105 Nov 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fairsketch Cross-site scripting in Fairsketch (CVE-2025-41103). Risk of unauthorized operations or information disclosure. CVE-2025-41103 Nov 11, 2025
Medium 6.1 Cross-Site Scripting (XSS) in KVKNET Cross-site scripting in KVKNET (CVE-2025-11960). Risk of unauthorized operations or information disclosure. CVE-2025-11960 Nov 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fairsketch Cross-site scripting in Fairsketch (CVE-2025-41101). Risk of unauthorized operations or information disclosure. CVE-2025-41101 Nov 11, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Fairsketch Cross-site scripting in Fairsketch (CVE-2025-41102). Risk of unauthorized operations or information disclosure. CVE-2025-41102 Nov 11, 2025
High 7.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2025-7632). Confidential information can be exposed externally. CVE-2025-7632 Nov 11, 2025