Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 8,783
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 894188 Cwe 8624077 Cwe 2844037 Cwe 4163898 Cwe 1193186 Cwe 2003160 Cwe 1253129 Cwe 202861 Cwe 222781 Cwe 7872527 Cwe 782043 Cwe 941886 Cwe 8631885 Cwe 741810 Cwe 1221802

🛡 Vulnerabilities tagged with this 9,069

Image ID Title
CVE-2026-33240 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting…
CVE-2026-69233 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69233)
CVE-2026-69230 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69230)
CVE-2026-69231 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69231)
CVE-2026-69238 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69238)
CVE-2026-69229 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69229)
CVE-2026-69234 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69234)
CVE-2026-69232 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69232)
CVE-2026-69236 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69236)
CVE-2026-69235 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69235)
CVE-2026-69237 Cross-Site Scripting (XSS) in Esri Portal for ArcGIS (CVE-2026-69237)
CVE-2026-30890 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)…
CVE-2026-31880 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)…
CVE-2026-31803 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site…
CVE-2026-30826 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)…
CVE-2026-30865 Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS)…
CVE-2026-77811 Cross-Site Scripting (XSS) in Amazon OpenSearch Dashboards (CVE-2026-77811)
CVE-2026-63135 Cross-Site Scripting (XSS) in yourls/yourls (CVE-2026-63135)
CVE-2026-61824 Cross-Site Scripting (XSS) in defuddle (CVE-2026-61824)
CVE-2026-74252 Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4...
CVE-2026-30819 Cross-Site Scripting (XSS) in /pages/ajax.render.php (CVE-2026-30819)
CVE-2026-55850 Cross-Site Scripting (XSS) in Element Web (CVE-2026-55850)
CVE-2026-54682 DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting…
CVE-2026-54681 DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in…
CVE-2026-75933 Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts...
CVE-2026-77028 Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect...
CVE-2026-76612 Cross-Site Scripting (XSS) in Zoo (CVE-2026-76612)
CVE-2026-73537 Cross-Site Scripting (XSS) in Miraikan Assist App (CVE-2026-73537)
CVE-2026-14325 Cross-Site Scripting (XSS) in WordPress (CVE-2026-14325)
CVE-2026-65644 Cross-Site Scripting (XSS) in Rocketchat (CVE-2026-65644)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details