Sign in Sign up
JA · EN · FR
SecPulse

Cwe 79

🧬 CWE Related 66
slug: cwe-79

Explanation

CWE-79は「Webアプリがユーザー入力をきちんと無害化せずに画面に出力してしまう欠陥」のことです。 結果として、攻撃者はWebページに悪意あるJavaScriptを埋め込めるようになり、見た人のCookie (ログイン情報) や入力情報を盗めるようになります。 対策はWebの基本中の基本: 出力時のHTMLエスケープです。
📌 Example
MySpace ワーム「Samy」 (2005): 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した。
🔗 Related links

🔖 Related tags

Cwe 20125 Cwe 78120 Cwe 787105 Cwe 41699 Cwe 2296 Cwe 11990 Cwe 9484 Cwe 50270 Cwe 8954 Cwe 91844 Cwe 28443 Cwe 28741 Cwe 7740 Cwe 30638 Cwe 84337

🛡 Vulnerabilities tagged with this 5,210

ID Title
CVE-2026-48081 Cross-Site Scripting (XSS) in CVE-2026-48081 (CVE-2026-48081)
CVE-2026-47185 Cross-Site Scripting (XSS) in CVE-2026-47185 (CVE-2026-47185)
CVE-2026-19110 Cross-Site Scripting (XSS) in CVE-2026-19110 (CVE-2026-19110)
CVE-2025-6508 Cross-Site Scripting (XSS) in CVE-2025-6508 (CVE-2025-6508)
CVE-2024-39024 In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.
CVE-2026-71497 Cross-Site Scripting (XSS) in org.jsoup:jsoup (CVE-2026-71497)
CVE-2026-71478 Cross-Site Scripting (XSS) in league/commonmark (CVE-2026-71478)
CVE-2026-54717 Cross-Site Scripting (XSS) in silverstripe/cms (CVE-2026-54717)
CVE-2026-71435 Cross-Site Scripting (XSS) in statamic/cms (CVE-2026-71435)
CVE-2026-66711 Cross-Site Scripting (XSS) in CVE-2026-66711 (CVE-2026-66711)
CVE-2026-66702 Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
CVE-2026-66706 Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
CVE-2026-66703 Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
CVE-2026-66707 Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
CVE-2026-66705 Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
CVE-2026-66690 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
CVE-2026-66694 Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
CVE-2026-66688 Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
CVE-2026-66664 Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.
CVE-2026-66457 Unauthenticated Cross Site Scripting (XSS) in Events Manager <= 7.4.1 versions.
CVE-2026-66663 Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
CVE-2026-66440 Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
CVE-2026-66439 Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
CVE-2026-65560 Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
CVE-2026-65565 Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
CVE-2026-65545 Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
CVE-2026-65544 Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
CVE-2026-65515 Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
CVE-2026-65513 Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
CVE-2026-65509 Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

🍪 About cookies

We use cookies to keep you logged in, remember your language, and improve the service.

Details →