Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,206

Medium 6.1 Cross-Site Scripting (XSS) in Limesurvey v.6.15.20+251021 Cross-site scripting in Limesurvey v.6.15.20+251021 (CVE-2025-70797). Risk of unauthorized operations or information disclosure. CVE-2025-70797 Apr 10, 03:16
Medium 5.4 Cross-Site Scripting (XSS) in Kiamo Cross-site scripting in Kiamo (CVE-2025-70365). Risk of unauthorized operations or information disclosure. CVE-2025-70365 Apr 10, 01:16
Low 2.4 Cross-Site Scripting (XSS) in code-projects Online Shoe Store Cross-site scripting in code-projects Online Shoe Store (CVE-2026-5835). Risk of unauthorized operations or information disclosure. CVE-2026-5835 Apr 9, 13:17
Low 2.4 Cross-Site Scripting (XSS) in code-projects Online Shoe Store Cross-site scripting in code-projects Online Shoe Store (CVE-2026-5836). Risk of unauthorized operations or information disclosure. CVE-2026-5836 Apr 9, 13:17
Low 2.4 Cross-Site Scripting (XSS) in code-projects Online Shoe Store Cross-site scripting in code-projects Online Shoe Store (CVE-2026-5834). Risk of unauthorized operations or information disclosure. CVE-2026-5834 Apr 9, 13:17
Medium 6.4 Cross-Site Scripting (XSS) in OSM – OpenStreetMap (WordPress plugin) Cross-site scripting in OSM – OpenStreetMap (WordPress plugin) (CVE-2026-4429). Risk of unauthorized operations or information disclosure. CVE-2026-4429 Apr 9, 13:17
Medium 6.4 Cross-Site Scripting (XSS) in Download Manager (WordPress plugin) Cross-site scripting in Download Manager (WordPress plugin) (CVE-2026-5357). Risk of unauthorized operations or information disclosure. CVE-2026-5357 Apr 9, 13:17
Medium 4.4 Cross-Site Scripting (XSS) in Experto Dashboard for WooCommerce (WordPress plugin) Cross-site scripting in Experto Dashboard for WooCommerce (WordPress plugin) (CVE-2026-3574). Risk of unauthorized operations or information disclosure. CVE-2026-3574 Apr 9, 13:17
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Cross-site scripting in code-projects Simple (CVE-2026-5826). Risk of unauthorized operations or information disclosure. CVE-2026-5826 Apr 9, 10:16
Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5825). Risk of unauthorized operations or information disclosure. CVE-2026-5825 Apr 9, 10:16
Medium 5.4 Cross-Site Scripting (XSS) in Gitlab Cross-site scripting in Gitlab (CVE-2026-4332). Risk of unauthorized operations or information disclosure. CVE-2026-4332 Apr 9, 08:16
Medium 6.1 Cross-Site Scripting (XSS) in Sonatype Nexus Repository Manager Cross-site scripting in Sonatype Nexus Repository Manager (CVE-2026-3438). Risk of unauthorized operations or information disclosure. CVE-2026-3438 Apr 9, 08:16
Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Sales and Inventory System Cross-site scripting in SourceCodester Sales and Inventory System (CVE-2026-5810). Risk of unauthorized operations or information disclosure. CVE-2026-5810 Apr 9, 07:16
Medium 6.4 Cross-Site Scripting (XSS) in Post Blocks & Tools (WordPress plugin) Cross-site scripting in Post Blocks & Tools (WordPress plugin) (CVE-2026-5711). Risk of unauthorized operations or information disclosure. CVE-2026-5711 Apr 9, 07:16
Low 3.5 Cross-Site Scripting (XSS) in code-projects Easy Blog Site Cross-site scripting in code-projects Easy Blog Site (CVE-2026-5806). Risk of unauthorized operations or information disclosure. CVE-2026-5806 Apr 9, 07:16
Medium 4.3 Cross-Site Scripting (XSS) in openstatusHQ openstatus Cross-site scripting in openstatusHQ openstatus (CVE-2026-5808). Risk of unauthorized operations or information disclosure. CVE-2026-5808 Apr 9, 07:16
Medium 5.4 Cross-Site Scripting (XSS) in Hayabusa Cross-site scripting in Hayabusa (CVE-2026-40028). Risk of unauthorized operations or information disclosure. CVE-2026-40028 Apr 9, 07:16
Medium 6.4 Cross-Site Scripting (XSS) in Extensions for Leaflet Map (WordPress plugin) Cross-site scripting in Extensions for Leaflet Map (WordPress plugin) (CVE-2026-5451). Risk of unauthorized operations or information disclosure. CVE-2026-5451 Apr 9, 06:17
Medium 6.1 Cross-Site Scripting (XSS) in AIL Framework Cross-site scripting in AIL Framework (CVE-2026-39416). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 6.8 or later. CVE-2026-39416 Apr 9, 06:16
High 7.3 Cross-Site Scripting (XSS) in immich Cross-site scripting in immich (CVE-2026-35455). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 2.7.0 or later. CVE-2026-35455 Apr 9, 04:25
High 8.7 Cross-Site Scripting (XSS) in Mcgill Cross-site scripting in Mcgill (CVE-2026-35169). Confidential information can be exposed externally. Mitigation: upgrade to 27.0.3 or later. CVE-2026-35169 Apr 9, 04:25
Medium 6.5 Cross-Site Scripting (XSS) in Mcgill Cross-site scripting in Mcgill (CVE-2026-35403). Confidential information can be exposed externally. Mitigation: upgrade to 27.0.3 or later. CVE-2026-35403 Apr 9, 04:25
Medium 5.5 Cross-Site Scripting (XSS) in CI4MS Cross-site scripting in CI4MS (CVE-2026-39392). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 0.31.4.0 or later. CVE-2026-39392 Apr 9, 00:16
Medium 4.8 Cross-Site Scripting (XSS) in CI4MS Cross-site scripting in CI4MS (CVE-2026-39391). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 0.31.4.0 or later. CVE-2026-39391 Apr 9, 00:16
Medium 5.5 Cross-Site Scripting (XSS) in CI4MS Cross-site scripting in CI4MS (CVE-2026-39390). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 0.31.4.0 or later. CVE-2026-39390 Apr 9, 00:16
Medium 6.4 Cross-Site Scripting (XSS) in Page Builder: Pagelayer (WordPress plugin) Cross-site scripting in Page Builder: Pagelayer (WordPress plugin) (CVE-2026-2509). Risk of unauthorized operations or information disclosure. CVE-2026-2509 Apr 8, 23:16
High 7.6 Cross-Site Scripting (XSS) in Coolercontrol Cross-site scripting in Coolercontrol (CVE-2026-5301). Data can be tampered with by attackers. CVE-2026-5301 Apr 8, 22:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-2481). Risk of unauthorized operations or information disclosure. CVE-2026-2481 Apr 8, 21:16
Medium 6.4 Cross-Site Scripting (XSS) in WP Visitor Statistics (WordPress plugin) Cross-site scripting in WP Visitor Statistics (WordPress plugin) (CVE-2026-4303). Risk of unauthorized operations or information disclosure. CVE-2026-4303 Apr 8, 19:16
Medium 6.4 Cross-Site Scripting (XSS) in pdfl.io (WordPress plugin) Cross-site scripting in pdfl.io (WordPress plugin) (CVE-2026-4073). Risk of unauthorized operations or information disclosure. CVE-2026-4073 Apr 8, 19:16