Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 5.4 Cross-Site Scripting (XSS) in Juzaweb CMS Cross-site scripting in Juzaweb CMS (CVE-2026-36358). Risk of unauthorized operations or information disclosure. CVE-2026-36358 May 6, 23:16
Low 3.1 Vulnerability in HCL DFXAnalytics CVE-2025-59854 May 6, 20:16
Medium 5.3 Vulnerability in HCL DFXAnalytics CVE-2025-31970 May 6, 20:16
Medium 6.8 Cross-Site Scripting (XSS) in Zabbix Cross-site scripting in Zabbix (CVE-2026-23928). Successful exploitation can lead to full system takeover. CVE-2026-23928 May 6, 17:16
Medium 6.8 Cross-Site Scripting (XSS) in Zabbix Cross-site scripting in Zabbix (CVE-2026-23926). Successful exploitation can lead to full system takeover. CVE-2026-23926 May 6, 17:16
Medium 6.1 Cross-Site Scripting (XSS) in github.com/prometheus/prometheus Cross-site scripting in github.com/prometheus/prometheus (CVE-2026-44903). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 0.311.3 or later. CVE-2026-44903 May 6, 06:53
Medium 5.4 Cross-Site Scripting (XSS) in phpoffice/phpspreadsheet Cross-site scripting in phpoffice/phpspreadsheet (CVE-2026-35453). Risk of unauthorized operations or information disclosure. Exploitable via formatColor. Mitigation: upgrade to 1.30.4 or later. CVE-2026-35453 May 6, 05:16
Medium 6.1 Cross-Site Scripting (XSS) in FluentCMS Cross-site scripting in FluentCMS (CVE-2026-38947). Risk of unauthorized operations or information disclosure. CVE-2026-38947 May 6, 05:16
Medium 6.1 Cross-Site Scripting (XSS) in ERPNext Cross-site scripting in ERPNext (CVE-2026-38432). Risk of unauthorized operations or information disclosure. CVE-2026-38432 May 6, 02:17
Medium 4.7 Cross-Site Scripting (XSS) in ISPConfig Cross-site scripting in ISPConfig (CVE-2025-52206). Risk of unauthorized operations or information disclosure. CVE-2025-52206 May 6, 01:16
Medium 5.4 Cross-Site Scripting (XSS) in Traccar Cross-site scripting in Traccar (CVE-2026-27694). Risk of unauthorized operations or information disclosure. CVE-2026-27694 May 5, 22:16
Medium 6.1 Cross-Site Scripting (XSS) in Dify Cross-site scripting in Dify (CVE-2026-42138). Risk of unauthorized operations or information disclosure. Exploitable via POST /api/files/upload. CVE-2026-42138 May 5, 03:16
Medium 4.6 Cross-Site Scripting (XSS) in openc3 Cross-site scripting in openc3 (CVE-2026-42086). Risk of unauthorized operations or information disclosure. Exploitable via convertToValue. Mitigation: upgrade to 7.0.0 or later. CVE-2026-42086 May 5, 03:16
Unrated Cross-Site Scripting (XSS) in beets Cross-site scripting in beets (CVE-2026-42052). Risk of unauthorized operations or information disclosure. Exploitable via title. Mitigation: upgrade to 2.10.0 or later. CVE-2026-42052 May 5, 03:16
Critical 9.6 Cross-Site Scripting (XSS) in Notesnook Cross-site scripting in Notesnook (CVE-2026-42090). Successful exploitation can lead to full system takeover. CVE-2026-42090 May 5, 02:16
Critical 9.8 Cross-Site Scripting (XSS) in Online Support Application Cross-site scripting in Online Support Application (CVE-2025-14320). Successful exploitation can lead to full system takeover. CVE-2025-14320 May 4, 18:15
Medium 6.9 Cross-Site Scripting (XSS) in V2Board Cross-site scripting in V2Board (CVE-2026-37503). Confidential information can be exposed externally. CVE-2026-37503 May 2, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56537). Risk of unauthorized operations or information disclosure. CVE-2025-56537 Apr 30, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56534). Risk of unauthorized operations or information disclosure. CVE-2025-56534 Apr 30, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56536). Risk of unauthorized operations or information disclosure. CVE-2025-56536 Apr 30, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56535). Risk of unauthorized operations or information disclosure. CVE-2025-56535 Apr 30, 01:16
Medium 6.1 Cross-Site Scripting (XSS) in Wso2 Identity Server Cross-site scripting in Wso2 Identity Server (CVE-2025-10503). Risk of unauthorized operations or information disclosure. CVE-2025-10503 Apr 29, 18:16
High 7.2 Cross-Site Scripting (XSS) in GCHQ CyberChef Cross-site scripting in GCHQ CyberChef (CVE-2026-42615). Risk of unauthorized operations or information disclosure. CVE-2026-42615 Apr 29, 13:16
Medium 5.4 Cross-Site Scripting (XSS) in phpoffice/phpspreadsheet Cross-site scripting in phpoffice/phpspreadsheet (CVE-2026-40296). Risk of unauthorized operations or information disclosure. Exploitable via General. Mitigation: upgrade to 1.30.4 or later. CVE-2026-40296 Apr 29, 07:57
Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-7296). Risk of unauthorized operations or information disclosure. CVE-2026-7296 Apr 29, 07:16
Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-7297). Risk of unauthorized operations or information disclosure. CVE-2026-7297 Apr 29, 07:16
Medium 6.1 Cross-Site Scripting (XSS) in School Management System by mahmoudai1 Cross-site scripting in School Management System by mahmoudai1 (CVE-2026-37750). Risk of unauthorized operations or information disclosure. CVE-2026-37750 Apr 29, 07:16
Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-7295). Risk of unauthorized operations or information disclosure. CVE-2026-7295 Apr 29, 04:37
High 8.9 Cross-Site Scripting (XSS) in HTMLy Cross-site scripting in HTMLy (CVE-2026-38949). Confidential information can be exposed externally. CVE-2026-38949 Apr 29, 04:37
Low 3.5 Cross-Site Scripting (XSS) in code-projects Coaching Management System Cross-site scripting in code-projects Coaching Management System (CVE-2026-7222). Risk of unauthorized operations or information disclosure. CVE-2026-7222 Apr 28, 13:16