Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,207

High 7.1 Cross-Site Scripting (XSS) in Link Whisper Free Cross-site scripting in Link Whisper Free (CVE-2025-67927). Risk of unauthorized operations or information disclosure. CVE-2025-67927 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Grand Restaurant Cross-site scripting in Grand Restaurant (CVE-2025-67922). Risk of unauthorized operations or information disclosure. CVE-2025-67922 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in eHive Search Cross-site scripting in eHive Search (CVE-2025-67930). Risk of unauthorized operations or information disclosure. CVE-2025-67930 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Woffice Cross-site scripting in Woffice (CVE-2025-67918). Risk of unauthorized operations or information disclosure. CVE-2025-67918 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in Jobify Cross-site scripting in Jobify (CVE-2025-67916). Risk of unauthorized operations or information disclosure. CVE-2025-67916 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in CountDown With Image or Video Background Cross-site scripting in CountDown With Image or Video Background (CVE-2025-27002). Risk of unauthorized operations or information disclosure. CVE-2025-27002 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in WP Virtual Assistant Cross-site scripting in WP Virtual Assistant (CVE-2025-22725). Risk of unauthorized operations or information disclosure. CVE-2025-22725 Jan 8, 19:15
High 7.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-27004). Risk of unauthorized operations or information disclosure. CVE-2025-27004 Jan 8, 19:15
Medium 6.4 Cross-Site Scripting (XSS) in Gutenverse Form (WordPress plugin) Cross-site scripting in Gutenverse Form (WordPress plugin) (CVE-2025-14984). Risk of unauthorized operations or information disclosure. CVE-2025-14984 Jan 8, 19:15
Medium 5.4 Cross-Site Scripting (XSS) in Ngsurvey Cross-site scripting in Ngsurvey (CVE-2025-15479). Risk of unauthorized operations or information disclosure. CVE-2025-15479 Jan 7, 23:15
High 7.1 Cross-Site Scripting (XSS) in WidgetKit Pro Cross-site scripting in WidgetKit Pro (CVE-2025-46494). Risk of unauthorized operations or information disclosure. CVE-2025-46494 Jan 7, 22:15
High 7.1 Cross-Site Scripting (XSS) in Arlo Cross-site scripting in Arlo (CVE-2025-69082). Risk of unauthorized operations or information disclosure. CVE-2025-69082 Jan 7, 21:17
High 7.1 Cross-Site Scripting (XSS) in DZS Video Gallery Cross-site scripting in DZS Video Gallery (CVE-2025-32300). Risk of unauthorized operations or information disclosure. CVE-2025-32300 Jan 7, 21:17
Medium 4.4 Cross-Site Scripting (XSS) in Page Keys (WordPress plugin) Cross-site scripting in Page Keys (WordPress plugin) (CVE-2025-15000). Risk of unauthorized operations or information disclosure. CVE-2025-15000 Jan 7, 21:16
Medium 6.1 Cross-Site Scripting (XSS) in HBLPAY Payment Gateway for WooCommerce (WordPress plugin) Cross-site scripting in HBLPAY Payment Gateway for WooCommerce (WordPress plugin) (CVE-2025-14875). Risk of unauthorized operations or information disclosure. CVE-2025-14875 Jan 7, 21:16
Medium 4.4 Cross-Site Scripting (XSS) in twinklesmtp – Email Service Provider For (WordPress plugin) Cross-site scripting in twinklesmtp – Email Service Provider For (WordPress plugin) (CVE-2025-14887). Risk of unauthorized operations or information disclosure. CVE-2025-14887 Jan 7, 21:16
Medium 4.4 Cross-Site Scripting (XSS) in Simple User Meta Editor (WordPress plugin) Cross-site scripting in Simple User Meta Editor (WordPress plugin) (CVE-2025-14888). Risk of unauthorized operations or information disclosure. CVE-2025-14888 Jan 7, 21:16
Medium 6.4 Cross-Site Scripting (XSS) in Customer Reviews for WooCommerce (WordPress plugin) Cross-site scripting in Customer Reviews for WooCommerce (WordPress plugin) (CVE-2025-14891). Risk of unauthorized operations or information disclosure. CVE-2025-14891 Jan 7, 21:16
Medium 6.4 Cross-Site Scripting (XSS) in My Album Gallery (WordPress plugin) Cross-site scripting in My Album Gallery (WordPress plugin) (CVE-2025-14796). Risk of unauthorized operations or information disclosure. CVE-2025-14796 Jan 7, 21:16
Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13887). Risk of unauthorized operations or information disclosure. Exploitable via ai_botkit_widget. CVE-2025-13887 Jan 7, 21:16
High 7.1 Cross-Site Scripting (XSS) in WPCHURCH Cross-site scripting in WPCHURCH (CVE-2025-31642). Risk of unauthorized operations or information disclosure. CVE-2025-31642 Jan 7, 11:14
High 7.1 Cross-Site Scripting (XSS) in Woocommerce Sales Funnel Builder Cross-site scripting in Woocommerce Sales Funnel Builder (CVE-2025-30631). Risk of unauthorized operations or information disclosure. CVE-2025-30631 Jan 7, 06:15
Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69357). Risk of unauthorized operations or information disclosure. CVE-2025-69357 Jan 7, 02:15
Medium 5.9 Cross-Site Scripting (XSS) in UiChemy Cross-site scripting in UiChemy (CVE-2025-69362). Risk of unauthorized operations or information disclosure. CVE-2025-69362 Jan 7, 02:15
Medium 6.5 Cross-Site Scripting (XSS) in TheGem Theme Elements Cross-site scripting in TheGem Theme Elements (CVE-2025-69360). Risk of unauthorized operations or information disclosure. CVE-2025-69360 Jan 7, 02:15
Medium 5.9 Cross-Site Scripting (XSS) in Accordion Cross-site scripting in Accordion (CVE-2025-69350). Risk of unauthorized operations or information disclosure. CVE-2025-69350 Jan 7, 02:15
Medium 6.5 Cross-Site Scripting (XSS) in Team Showcase Cross-site scripting in Team Showcase (CVE-2025-69335). Risk of unauthorized operations or information disclosure. CVE-2025-69335 Jan 7, 02:15
Medium 6.5 Cross-Site Scripting (XSS) in Wishlist for WooCommerce Cross-site scripting in Wishlist for WooCommerce (CVE-2025-69334). Risk of unauthorized operations or information disclosure. CVE-2025-69334 Jan 7, 02:15
High 7.1 Cross-Site Scripting (XSS) in Photo Gallery Cross-site scripting in Photo Gallery (CVE-2025-69084). Risk of unauthorized operations or information disclosure. CVE-2025-69084 Jan 7, 02:15
High 7.1 Cross-Site Scripting (XSS) in JobBank Cross-site scripting in JobBank (CVE-2025-69085). Risk of unauthorized operations or information disclosure. CVE-2025-69085 Jan 7, 02:15