Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,678
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894152 Cwe 8624031 Cwe 2844027 Cwe 4163896 Cwe 1193182 Cwe 2003138 Cwe 1253115 Cwe 202856 Cwe 222769 Cwe 7872517 Cwe 782021 Cwe 941870 Cwe 8631865 Cwe 1221799 Cwe 741796

🛡 Vulnerabilities tagged with this 8,692

Image ID Title
CVE-2026-109701 Cross-Site Scripting (XSS) in PAYCOMET for WooCommerce (CVE-2026-109701)
CVE-2026-109983 Cross-Site Scripting (XSS) in YMC Filter (WordPress plugin) (CVE-2026-109983)
CVE-2026-111110 Cross-Site Scripting (XSS) in WordPress (CVE-2026-111110)
CVE-2026-100316 Cross-Site Scripting (XSS) in European VAT Compliance Assistant for WooCommerce (WordPress plugin) (CVE-2026-100316)
CVE-2026-110384 Cross-Site Scripting (XSS) in Fancy Comments WordPress (CVE-2026-110384)
CVE-2026-96660 Cross-Site Scripting (XSS) in WordPress (CVE-2026-96660)
CVE-2026-111726 Cross-Site Scripting (XSS) in Themify Builder (WordPress plugin) (CVE-2026-111726)
CVE-2026-109989 Cross-Site Scripting (XSS) in Themify Popup (WordPress plugin) (CVE-2026-109989)
CVE-2026-109985 Cross-Site Scripting (XSS) in WordPress (CVE-2026-109985)
CVE-2026-103899 Cross-Site Scripting (XSS) in EU VAT Assistant for WooCommerce (WordPress plugin) (CVE-2026-103899)
CVE-2026-111601 Cross-Site Scripting (XSS) in Hippoo Mobile App for WooCommerce (WordPress plugin) (CVE-2026-111601)
CVE-2026-109208 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is...
CVE-2026-111713 Cross-Site Scripting (XSS) in tarteaucitron.js (CVE-2026-111713)
CVE-2026-44977 Cross-Site Scripting (XSS) in countly-server (CVE-2026-44977)
CVE-2026-97470 Cross-Site Scripting (XSS) in WordPress (CVE-2026-97470)
CVE-2026-90821 Cross-Site Scripting (XSS) in Crafty Controller (CVE-2026-90821)
CVE-2026-111400 Cross-Site Scripting (XSS) in PowerPack Addons for Elementor (CVE-2026-111400)
CVE-2026-110903 Cross-Site Scripting (XSS) in Events Calendar (CVE-2026-110903)
CVE-2026-111405 Cross-Site Scripting (XSS) in MapSVG (CVE-2026-111405)
CVE-2026-96768 Cross-Site Scripting (XSS) in GoSMTP Pro (WordPress plugin) (CVE-2026-96768)
CVE-2026-107649 Cross-Site Scripting (XSS) in Events Made Easy (WordPress plugin) (CVE-2026-107649)
CVE-2026-110703 Cross-Site Scripting (XSS) in WordPress (CVE-2026-110703)
CVE-2026-107648 Cross-Site Scripting (XSS) in WP Sessions Time Monitoring Full Automatic (WordPress plugin) (CVE-2026-107648)
CVE-2026-93681 Cross-Site Scripting (XSS) in Tutor LMS – eLearning and online course solution (WordPress plugin) (CVE-2026-93681)
CVE-2026-104726 Cross-Site Scripting (XSS) in Name Directory (WordPress plugin) (CVE-2026-104726)
CVE-2026-87111 Cross-Site Scripting (XSS) in WordPress (CVE-2026-87111)
CVE-2026-109224 Cross-Site Scripting (XSS) in WordPress (CVE-2026-109224)
CVE-2026-96870 Cross-Site Scripting (XSS) in SureDash – Community, Courses & Member Dashboard (WordPress plugin) (CVE-2026-96870)
CVE-2026-97640 Cross-Site Scripting (XSS) in WordPress (CVE-2026-97640)
CVE-2026-96339 Cross-Site Scripting (XSS) in Houzez (CVE-2026-96339)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details