Cwe 79

🧬 CWE Related 9,173

slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。対策はWebの基本中の基本: 出力時のHTMLエスケープです。

Example

MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。

Related tags

Cwe 894379 Cwe 8624272 Cwe 2844116 Cwe 4163958 Cwe 1193244 Cwe 2003244 Cwe 1253187 Cwe 202918 Cwe 222868 Cwe 7872615 Cwe 782110 Cwe 942003 Cwe 741960 Cwe 8631940 Cwe 1221847

Vulnerabilities tagged with this 9,219

Medium 6.4 Cross-Site Scripting (XSS) in List Attachments Shortcode (WordPress plugin) Cross-site scripting in List Attachments Shortcode (WordPress plugin) (CVE-2025-12717). Risk of unauthorized operations or information disclosure. CVE-2025-12717 Dec 6, 2025
High 7.2 Cross-Site Scripting (XSS) in Widgets for Google Reviews (WordPress plugin) Cross-site scripting in Widgets for Google Reviews (WordPress plugin) (CVE-2025-12510). Risk of unauthorized operations or information disclosure. CVE-2025-12510 Dec 6, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Link Whisper Free (WordPress plugin) Cross-site scripting in Link Whisper Free (WordPress plugin) (CVE-2025-11263). Risk of unauthorized operations or information disclosure. CVE-2025-11263 Dec 6, 2025
Critical 9.6 Cross-Site Scripting (XSS) in TUUI Cross-site scripting in TUUI (CVE-2025-66562). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 1.3.4 or later. CVE-2025-66562 Dec 6, 2025
Low 3.5 Cross-Site Scripting (XSS) in Nextcloud Cross-site scripting in Nextcloud (CVE-2025-66554). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 5.5.4 or later. CVE-2025-66554 Dec 6, 2025
Low 3.5 Cross-Site Scripting (XSS) in Nextcloud Mail Cross-site scripting in Nextcloud Mail (CVE-2025-66514). Risk of unauthorized operations or information disclosure. CVE-2025-66514 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34265). Risk of unauthorized operations or information disclosure. CVE-2025-34265 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34264). Risk of unauthorized operations or information disclosure. CVE-2025-34264 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34263). Risk of unauthorized operations or information disclosure. CVE-2025-34263 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34266). Risk of unauthorized operations or information disclosure. CVE-2025-34266 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34260). Risk of unauthorized operations or information disclosure. CVE-2025-34260 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34261). Risk of unauthorized operations or information disclosure. CVE-2025-34261 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34258). Risk of unauthorized operations or information disclosure. CVE-2025-34258 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34262). Risk of unauthorized operations or information disclosure. CVE-2025-34262 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34259). Risk of unauthorized operations or information disclosure. CVE-2025-34259 Dec 6, 2025
Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34257). Risk of unauthorized operations or information disclosure. CVE-2025-34257 Dec 6, 2025
Medium 5.4 Vulnerability in Nextcloud CVE-2025-66512 Dec 6, 2025
Critical 9.6 Cross-Site Scripting (XSS) in Fanvil Cross-site scripting in Fanvil (CVE-2025-64054). Successful exploitation can lead to full system takeover. CVE-2025-64054 Dec 6, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Thai Lottery Widget (WordPress plugin) Cross-site scripting in Thai Lottery Widget (WordPress plugin) (CVE-2025-13678). Risk of unauthorized operations or information disclosure. Exploitable via thailottery. CVE-2025-13678 Dec 5, 2025
Medium 4.4 Cross-Site Scripting (XSS) in Trail Manager (WordPress plugin) Cross-site scripting in Trail Manager (WordPress plugin) (CVE-2025-13682). Risk of unauthorized operations or information disclosure. CVE-2025-13682 Dec 5, 2025
Medium 6.4 Cross-Site Scripting (XSS) in CryptX (WordPress plugin) Cross-site scripting in CryptX (WordPress plugin) (CVE-2025-13739). Risk of unauthorized operations or information disclosure. Exploitable via cryptx. CVE-2025-13739 Dec 5, 2025
High 8.1 Cross-Site Scripting (XSS) in Cool Tag Cloud (WordPress plugin) Cross-site scripting in Cool Tag Cloud (WordPress plugin) (CVE-2025-13614). Confidential information can be exposed externally. CVE-2025-13614 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Nouri.sh Newsletter (WordPress plugin) Cross-site scripting in Nouri.sh Newsletter (WordPress plugin) (CVE-2025-13515). Risk of unauthorized operations or information disclosure. CVE-2025-13515 Dec 5, 2025
Medium 4.4 Cross-Site Scripting (XSS) in Weekly Planner (WordPress plugin) Cross-site scripting in Weekly Planner (WordPress plugin) (CVE-2025-12186). Risk of unauthorized operations or information disclosure. CVE-2025-12186 Dec 5, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Easy Jump Links Menus (WordPress plugin) Cross-site scripting in Easy Jump Links Menus (WordPress plugin) (CVE-2025-13860). Risk of unauthorized operations or information disclosure. Exploitable via h_tags. CVE-2025-13860 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Jabbernotification (WordPress plugin) Cross-site scripting in Jabbernotification (WordPress plugin) (CVE-2025-13622). Risk of unauthorized operations or information disclosure. CVE-2025-13622 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13625). Risk of unauthorized operations or information disclosure. CVE-2025-13625 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in Twitscription (WordPress plugin) Cross-site scripting in Twitscription (WordPress plugin) (CVE-2025-13623). Risk of unauthorized operations or information disclosure. CVE-2025-13623 Dec 5, 2025
Medium 6.1 Cross-Site Scripting (XSS) in CoSign Single Signon (WordPress plugin) Cross-site scripting in CoSign Single Signon (WordPress plugin) (CVE-2025-13512). Risk of unauthorized operations or information disclosure. CVE-2025-13512 Dec 5, 2025
Medium 6.4 Cross-Site Scripting (XSS) in Sermon Manager (WordPress plugin) Cross-site scripting in Sermon Manager (WordPress plugin) (CVE-2025-12368). Risk of unauthorized operations or information disclosure. CVE-2025-12368 Dec 5, 2025