Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,783
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894188 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 9,068

Image ID Title
CVE-2026-6176 Cross-Site Scripting (XSS) in Customer Reviews for WooCommerce (WordPress plugin) (CVE-2026-6176)
CVE-2026-5800 Cross-Site Scripting (XSS) in E-Commerce Platform (CVE-2026-5800)
CVE-2026-5934 Cross-Site Scripting (XSS) in WP Rocket (WordPress plugin) (CVE-2026-5934)
CVE-2026-5953 Cross-Site Scripting (XSS) in Web Design (CVE-2026-5953)
CVE-2026-4378 Cross-Site Scripting (XSS) in E-Commerce Pack (CVE-2026-4378)
CVE-2026-3423 Cross-Site Scripting (XSS) in Envira Gallery (WordPress plugin) (CVE-2026-3423)
CVE-2026-38725 xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject...
CVE-2026-37710 Cross-Site Scripting (XSS) in Omeka S (CVE-2026-37710)
CVE-2026-6128 Cross-Site Scripting (XSS) in All-in-One WP Migration Unlimited Extension (WordPress plugin) (CVE-2026-6128)
CVE-2026-5510 Cross-Site Scripting (XSS) in GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin) (CVE-2026-5510)
CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 -...
CVE-2026-78073 Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user...
CVE-2026-9548 Cross-Site Scripting (XSS) in Synology Chat Server (CVE-2026-9548)
CVE-2026-82123 Cross-Site Scripting (XSS) in Tangible Loops & Logic (CVE-2026-82123)
CVE-2026-78238 Cross-Site Scripting (XSS) in SOY Gallery (CVE-2026-78238)
CVE-2026-73827 Cross-Site Scripting (XSS) in SOY Calendar (CVE-2026-73827)
CVE-2026-77838 Cross-Site Scripting (XSS) in SOY Calendar (CVE-2026-77838)
CVE-2026-6286 Cross-Site Scripting (XSS) in Booking for Appointments and Events Calendar – Amelia (WordPress plugin) (CVE-2026-6286)
CVE-2026-40541 Cross-Site Scripting (XSS) in Synology Chat Server (CVE-2026-40541)
CVE-2026-4246 Cross-Site Scripting (XSS) in ElementsKit Pro (WordPress plugin) (CVE-2026-4246)
CVE-2026-82089 The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS...
CVE-2026-82090 Cross-Site Scripting (XSS) in Pocket (CVE-2026-82090)
CVE-2026-76053 Cross-Site Scripting (XSS) in WordPress (CVE-2026-76053)
CVE-2026-77365 Cross-Site Scripting (XSS) in WordPress (CVE-2026-77365)
CVE-2026-3129 Cross-Site Scripting (XSS) in LiteSpeed Cache (WordPress plugin) (CVE-2026-3129)
CVE-2026-15798 Cross-Site Scripting (XSS) in Smart Slider (WordPress plugin) (CVE-2026-15798)
CVE-2026-16654 Cross-Site Scripting (XSS) in Avada (Fusion) Builder (WordPress plugin) (CVE-2026-16654)
CVE-2026-18978 Cross-Site Scripting (XSS) in LiteSpeed Cache (WordPress plugin) (CVE-2026-18978)
CVE-2026-18324 Cross-Site Scripting (XSS) in WordPress (CVE-2026-18324)
CVE-2026-78615 Cross-Site Scripting (XSS) in WatchGuard Dimension's report detail page (CVE-2026-78615)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details