Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,692
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 782028 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 8,734

Image ID Title
CVE-2026-90438 Cross-Site Scripting (XSS) in WordPress (CVE-2026-90438)
CVE-2026-91022 Cross-Site Scripting (XSS) in Motors (WordPress plugin) (CVE-2026-91022)
CVE-2026-85016 Cross-Site Scripting (XSS) in Unlimited Elements for Elementor (WordPress plugin) (CVE-2026-85016)
CVE-2026-78471 Cross-Site Scripting (XSS) in Autoptimize (WordPress plugin) (CVE-2026-78471)
CVE-2026-84925 Cross-Site Scripting (XSS) in Avada | Website Builder For WordPress & WooCommerce (WordPress theme) (CVE-2026-84925)
CVE-2026-13718 Cross-Site Scripting (XSS) in Tabs Responsive (WordPress plugin) (CVE-2026-13718)
CVE-2026-93367 Cross-Site Scripting (XSS) in Visitors Traffic Real Time Statistics Pro (WordPress plugin) (CVE-2026-93367)
CVE-2026-71454 Cross-Site Scripting (XSS) in CAPEC-63 (CVE-2026-71454)
CVE-2026-70650 Cross-Site Scripting (XSS) in GetSimple CMS (CVE-2026-70650)
CVE-2026-71542 Cross-Site Scripting (XSS) in GetSimple CMS (CVE-2026-71542)
CVE-2026-55230 Cross-Site Scripting (XSS) in Vvveb (CVE-2026-55230)
CVE-2026-101890 Cross-Site Scripting (XSS) in Prime Mover (WordPress plugin) (CVE-2026-101890)
CVE-2026-97273 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
CVE-2026-97268 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
CVE-2026-97260 Cross-Site Scripting (XSS) in MaxGalleria (CVE-2026-97260)
CVE-2026-56589 Cross-Site Scripting (XSS) in HCL BigFix Service Management (CVE-2026-56589)
CVE-2026-102378 Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.
CVE-2026-103686 Cross-Site Scripting (XSS) in rhukster dom-sanitizer (CVE-2026-103686)
CVE-2026-103339 Cross-Site Scripting (XSS) in Metform (CVE-2026-103339)
CVE-2026-103343 Cross-Site Scripting (XSS) in FluentForm (CVE-2026-103343)
CVE-2026-103064 Cross-Site Scripting (XSS) in ElementsKit Elementor addons Lite (CVE-2026-103064)
CVE-2026-102394 Cross-Site Scripting (XSS) in Essential Addons for Elementor (CVE-2026-102394)
CVE-2026-103063 Cross-Site Scripting (XSS) in ElementsKit Elementor addons Lite (CVE-2026-103063)
CVE-2026-103292 Cross-Site Scripting (XSS) in Ghost (CVE-2026-103292)
CVE-2026-103277 Cross-Site Scripting (XSS) in Ghost (CVE-2026-103277)
CVE-2026-103249 Cross-Site Scripting (XSS) in n8n (CVE-2026-103249)
CVE-2026-92144 Cross-Site Scripting (XSS) in WordPress (CVE-2026-92144)
CVE-2026-7176 CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-...
CVE-2026-96256 Cross-Site Scripting (XSS) in WordPress (CVE-2026-96256)
CVE-2026-64950 Missing input validation and output encoding on the directory name parameter in File Manager's...

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details