slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Plugin WP Symposium Pro Cross-site scripting in WordPress Plugin WP Symposium Pro (CVE-2021-47927). Risk of unauthorized operations or information disclosure. CVE-2021-47927
- Medium 6.4 Cross-Site Scripting (XSS) in Rocket LMS Cross-site scripting in Rocket LMS (CVE-2021-47907). Risk of unauthorized operations or information disclosure. CVE-2021-47907
- Medium 6.4 Cross-Site Scripting (XSS) in AccessPress Social Icons Cross-site scripting in AccessPress Social Icons (CVE-2021-47910). Risk of unauthorized operations or information disclosure. CVE-2021-47910
- Medium 6.1 Cross-Site Scripting (XSS) in libphp Cross-site scripting in libphp (CVE-2026-6735). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 8.2.31, 8.3.31, 8.4.21, 8.5.6 or later. CVE-2026-6735
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8219). Risk of unauthorized operations or information disclosure. CVE-2026-8219
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8218). Risk of unauthorized operations or information disclosure. CVE-2026-8218
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8221). Risk of unauthorized operations or information disclosure. CVE-2026-8221
- Low 2.4 Cross-Site Scripting (XSS) in Devs Palace ERP Online Cross-site scripting in Devs Palace ERP Online (CVE-2026-8220). Risk of unauthorized operations or information disclosure. CVE-2026-8220
- Medium 4.3 Cross-Site Scripting (XSS) in JeecgBoot Cross-site scripting in JeecgBoot (CVE-2026-8195). Risk of unauthorized operations or information disclosure. CVE-2026-8195
- Medium 5.4 Cross-Site Scripting (XSS) in Cisco Catalyst Sd Wan Manager Cross-site scripting in Cisco Catalyst Sd Wan Manager (CVE-2026-20108). Risk of unauthorized operations or information disclosure. CVE-2026-20108
- Medium 4.8 Cross-Site Scripting (XSS) in Cisco Identity Services Engine Cross-site scripting in Cisco Identity Services Engine (CVE-2025-20204). Risk of unauthorized operations or information disclosure. CVE-2025-20204
- Medium 6.1 Cross-Site Scripting (XSS) in Cisco Integrated Management Controller Cross-site scripting in Cisco Integrated Management Controller (CVE-2026-20085). Risk of unauthorized operations or information disclosure. CVE-2026-20085
- Medium 4.8 Cross-Site Scripting (XSS) in Cisco Identity Services Engine Cross-site scripting in Cisco Identity Services Engine (CVE-2026-20132). Risk of unauthorized operations or information disclosure. CVE-2026-20132
- Medium 6.1 Vulnerability in Cisco Webex Contact Center CVE-2026-20170
- Medium 6.1 Cross-Site Scripting (XSS) in mistune Cross-site scripting in mistune (CVE-2026-44896). Risk of unauthorized operations or information disclosure. Exploitable via figclass. Mitigation: upgrade to 3.2.1 or later. CVE-2026-44896
- Medium 6.3 Cross-Site Scripting (XSS) in Grimmory Cross-site scripting in Grimmory (CVE-2026-42451). Confidential information can be exposed externally. CVE-2026-42451
- High 7.3 Cross-Site Scripting (XSS) in open-webui Cross-site scripting in open-webui (CVE-2026-44549). Confidential information can be exposed externally. Exploitable via XLSX.utils.sheet_to_html. Mitigation: upgrade to 0.8.0 or later. CVE-2026-44549
- Medium 4.8 Cross-Site Scripting (XSS) in snipe/snipe-it Cross-site scripting in snipe/snipe-it (CVE-2026-44831). Risk of unauthorized operations or information disclosure. Exploitable via notes. Mitigation: upgrade to 8.4.1 or later. CVE-2026-44831
- Medium 5.4 Cross-Site Scripting (XSS) in Plunk Cross-site scripting in Plunk (CVE-2026-42192). Risk of unauthorized operations or information disclosure. CVE-2026-42192
- Unrated Cross-Site Scripting (XSS) in getgrav/grav Cross-site scripting in getgrav/grav (CVE-2026-44737). Risk of unauthorized operations or information disclosure. Exploitable via GET /admin/pages/. Mitigation: upgrade to 1.7.49.5 or later. CVE-2026-44737
- High 7.3 Cross-Site Scripting (XSS) in open-webui Cross-site scripting in open-webui (CVE-2026-44721). Confidential information can be exposed externally. Exploitable via marked. Mitigation: upgrade to 0.9.0 or later. CVE-2026-44721
- Medium 5.4 Vulnerability in github.com/modelcontextprotocol/registry CVE-2026-44429
- Medium 6.1 Vulnerability in MapServer WMS CVE-2026-42030
- Critical 9.8 Path Traversal in path-traversal CVE-2026-38360
- Critical 9.3 Cross-Site Scripting (XSS) in prestashop/prestashop Cross-site scripting in prestashop/prestashop (CVE-2026-44212). Confidential information can be exposed externally. Mitigation: upgrade to 9.1.1 or later. CVE-2026-44212
- Medium 6.1 Cross-Site Scripting (XSS) in absinthe_plug Cross-site scripting in absinthe_plug (CVE-2026-42794). Risk of unauthorized operations or information disclosure. CVE-2026-42794
- Medium 6.4 Cross-Site Scripting (XSS) in marko Cross-site scripting in marko (CVE-2026-41591). Risk of unauthorized operations or information disclosure. Exploitable via _escape_script. Mitigation: upgrade to 5.38.36 or later. CVE-2026-41591
- Medium 6.1 Cross-Site Scripting (XSS) in Th30D4Y Cross-site scripting in Th30D4Y (CVE-2026-41575). Risk of unauthorized operations or information disclosure. CVE-2026-41575
- Medium 6.4 Cross-Site Scripting (XSS) in Sky Addons (WordPress plugin) Cross-site scripting in Sky Addons (WordPress plugin) (CVE-2026-7475). Risk of unauthorized operations or information disclosure. Exploitable via sky_script_content. CVE-2026-7475
- Medium 6.4 Cross-Site Scripting (XSS) in E2Pdf – Export Pdf Tool for (WordPress plugin) Cross-site scripting in E2Pdf – Export Pdf Tool for (WordPress plugin) (CVE-2026-7650). Risk of unauthorized operations or information disclosure. CVE-2026-7650