slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Unrated Cross-Site Scripting (XSS) in mantisbt/mantisbt Cross-site scripting in mantisbt/mantisbt (CVE-2026-34463). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.28.2 or later. CVE-2026-34463
- Medium 4.0 Vulnerability in cowlib CVE-2026-43968
- Medium 6.1 Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute... Cross-site scripting reported (CVE-2026-36906). Risk of unauthorized operations or information disclosure. CVE-2026-36906
- Medium 5.4 Cross-Site Scripting (XSS) in HireFlow Cross-site scripting in HireFlow (CVE-2026-38569). Risk of unauthorized operations or information disclosure. Exploitable via POST /candidates/add. CVE-2026-38569
- Medium 5.7 Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to… Cross-site scripting reported (CVE-2026-41250). Confidential information can be exposed externally. Mitigation: upgrade to 6.9.1 or later. CVE-2026-41250
- Medium 5.4 Cross-Site Scripting (XSS) in getgrav/grav Cross-site scripting in getgrav/grav (CVE-2026-42842). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 9.1.0 or later. CVE-2026-42842
- Medium 4.8 Cross-Site Scripting (XSS) in pgadmin4 Cross-site scripting in pgadmin4 (CVE-2026-7814). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 9.15 or later. CVE-2026-7814
- High 8.9 Cross-Site Scripting (XSS) in getgrav/grav Cross-site scripting in getgrav/grav (CVE-2026-42611). Confidential information can be exposed externally. Mitigation: upgrade to 2.0.0-beta.2 or later. CVE-2026-42611
- High 8.5 Cross-Site Scripting (XSS) in getgrav/grav Cross-site scripting in getgrav/grav (CVE-2026-42612). Confidential information can be exposed externally. Mitigation: upgrade to 2.0.0-beta.2 or later. CVE-2026-42612
- Unrated Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform.... Cross-site scripting reported (CVE-2026-3320). Risk of unauthorized operations or information disclosure. CVE-2026-3320
- Unrated Reflected Cross-Site Scripting (XSS) in the latest demo version of the Cradle eCommerce platform.... Cross-site scripting reported (CVE-2026-3319). Risk of unauthorized operations or information disclosure. CVE-2026-3319
- Medium 6.1 docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting... Cross-site scripting reported (CVE-2025-65417). Risk of unauthorized operations or information disclosure. CVE-2025-65417
- Medium 6.1 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61308). Risk of unauthorized operations or information disclosure. CVE-2025-61308
- Medium 6.1 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61309). Risk of unauthorized operations or information disclosure. CVE-2025-61309
- Medium 6.1 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61310). Risk of unauthorized operations or information disclosure. CVE-2025-61310
- High 7.3 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61311). Confidential information can be exposed externally. CVE-2025-61311
- High 7.3 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61312). Confidential information can be exposed externally. CVE-2025-61312
- High 7.3 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61313). Confidential information can be exposed externally. CVE-2025-61313
- High 7.3 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61314). Confidential information can be exposed externally. CVE-2025-61314
- Medium 6.1 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61305). Risk of unauthorized operations or information disclosure. CVE-2025-61305
- Medium 6.1 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61306). Risk of unauthorized operations or information disclosure. CVE-2025-61306
- Medium 6.1 Cross-Site Scripting (XSS) in GmbH Mecury Managed Print Services (docuForm) Cross-site scripting in GmbH Mecury Managed Print Services (docuForm) (CVE-2025-61307). Risk of unauthorized operations or information disclosure. CVE-2025-61307
- Medium 4.7 Cross-Site Scripting (XSS) in next Cross-site scripting in next (CVE-2026-44581). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 16.2.5 or later. CVE-2026-44581
- Medium 6.1 Cross-Site Scripting (XSS) in next Cross-site scripting in next (CVE-2026-44580). Risk of unauthorized operations or information disclosure. Exploitable via beforeInteractive. Mitigation: upgrade to 16.2.5 or later. CVE-2026-44580
- Unrated Cross-Site Scripting (XSS) in ATutor Cross-site scripting in ATutor (CVE-2026-6909). Risk of unauthorized operations or information disclosure. CVE-2026-6909
- Unrated Cross-Site Scripting (XSS) in ATutor Cross-site scripting in ATutor (CVE-2026-6956). Risk of unauthorized operations or information disclosure. CVE-2026-6956
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8262). Risk of unauthorized operations or information disclosure. CVE-2026-8262
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8256). Risk of unauthorized operations or information disclosure. CVE-2026-8256
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8253). Risk of unauthorized operations or information disclosure. CVE-2026-8253
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8254). Risk of unauthorized operations or information disclosure. CVE-2026-8254