slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.4 Cross-Site Scripting (XSS) in NMR Strava activities (WordPress plugin) Cross-site scripting in NMR Strava activities (WordPress plugin) (CVE-2026-5341). Risk of unauthorized operations or information disclosure. Exploitable via strava_nmr_connect. CVE-2026-5341
- High 7.2 Cross-Site Scripting (XSS) in Auto Affiliate Links (WordPress plugin) Cross-site scripting in Auto Affiliate Links (WordPress plugin) (CVE-2026-7330). Risk of unauthorized operations or information disclosure. CVE-2026-7330
- Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2024-33724). Risk of unauthorized operations or information disclosure. CVE-2024-33724
- Medium 6.1 Cross-Site Scripting (XSS) in org.opencms:opencms-core Cross-site scripting in org.opencms:opencms-core (CVE-2023-42343). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 16.0 or later. CVE-2023-42343
- Medium 6.1 Cross-Site Scripting (XSS) in org.opencms:opencms-core Cross-site scripting in org.opencms:opencms-core (CVE-2023-42345). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 16.0 or later. CVE-2023-42345
- Medium 6.1 Cross-Site Scripting (XSS) in Thruk Monitoring Cross-site scripting in Thruk Monitoring (CVE-2022-23961). Risk of unauthorized operations or information disclosure. CVE-2022-23961
- Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System Cross-site scripting in SourceCodester Pharmacy Sales and Inventory System (CVE-2026-8136). Risk of unauthorized operations or information disclosure. CVE-2026-8136
- Medium 5.1 Cross-Site Scripting (XSS) in wlc Cross-site scripting in wlc (CVE-2026-42150). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.0.0 or later. CVE-2026-42150
- Medium 4.3 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-8117). Risk of unauthorized operations or information disclosure. CVE-2026-8117
- Medium 6.1 Cross-Site Scripting (XSS) in Vvveb Cross-site scripting in Vvveb (CVE-2026-41929). Risk of unauthorized operations or information disclosure. CVE-2026-41929
- High 8.8 Cross-Site Scripting (XSS) in Azure Machine Learning Cross-site scripting in Azure Machine Learning (CVE-2026-32207). Successful exploitation can lead to full system takeover. CVE-2026-32207
- Medium 6.1 Cross-Site Scripting (XSS) in golang Cross-site scripting in golang (CVE-2026-39823). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.25.10, 1.26.3 or later. CVE-2026-39823
- Medium 5.4 A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the… Cross-site scripting reported (CVE-2026-36388). Risk of unauthorized operations or information disclosure. CVE-2026-36388
- Medium 6.1 Cross-Site Scripting (XSS) in sidekiq-cron Cross-site scripting in sidekiq-cron (CVE-2025-67202). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.4.0 or later. CVE-2025-67202
- Medium 5.4 Cross-Site Scripting (XSS) in Misp Cross-site scripting in Misp (CVE-2026-8080). Risk of unauthorized operations or information disclosure. CVE-2026-8080
- Unrated Security update for webkit2gtk3 Vulnerability reported (SUSE-SU-2026:1749-1). Risk of unauthorized operations or information disclosure. SUSE-SU-2026:1749-1
- Medium 5.9 Cross-Site Scripting (XSS) in WEN Logo Slider Cross-site scripting in WEN Logo Slider (CVE-2025-62127). Risk of unauthorized operations or information disclosure. CVE-2025-62127
- Low 3.7 Vulnerability in HCL BigFix Service Management CVE-2025-31983
- Medium 5.4 Cross-Site Scripting (XSS) in Juzaweb CMS Cross-site scripting in Juzaweb CMS (CVE-2026-36358). Risk of unauthorized operations or information disclosure. CVE-2026-36358
- Low 3.1 Vulnerability in HCL DFXAnalytics CVE-2025-59854
- Medium 5.3 Vulnerability in HCL DFXAnalytics CVE-2025-31970
- Medium 5.4 Cross-Site Scripting (XSS) in phpoffice/phpspreadsheet Cross-site scripting in phpoffice/phpspreadsheet (CVE-2026-35453). Risk of unauthorized operations or information disclosure. Exploitable via formatColor. Mitigation: upgrade to 1.30.4 or later. CVE-2026-35453
- Medium 6.1 Cross-Site Scripting (XSS) in FluentCMS Cross-site scripting in FluentCMS (CVE-2026-38947). Risk of unauthorized operations or information disclosure. CVE-2026-38947
- Medium 6.1 Cross-Site Scripting (XSS) in ERPNext Cross-site scripting in ERPNext (CVE-2026-38432). Risk of unauthorized operations or information disclosure. CVE-2026-38432
- Medium 4.7 Cross-Site Scripting (XSS) in ISPConfig Cross-site scripting in ISPConfig (CVE-2025-52206). Risk of unauthorized operations or information disclosure. CVE-2025-52206
- Medium 6.1 Cross-Site Scripting (XSS) in Dify Cross-site scripting in Dify (CVE-2026-42138). Risk of unauthorized operations or information disclosure. Exploitable via POST /api/files/upload. CVE-2026-42138
- Medium 4.6 Cross-Site Scripting (XSS) in openc3 Cross-site scripting in openc3 (CVE-2026-42086). Risk of unauthorized operations or information disclosure. Exploitable via convertToValue. Mitigation: upgrade to 7.0.0 or later. CVE-2026-42086
- Critical 9.6 Cross-Site Scripting (XSS) in Notesnook Cross-site scripting in Notesnook (CVE-2026-42090). Successful exploitation can lead to full system takeover. CVE-2026-42090
- Critical 9.8 Cross-Site Scripting (XSS) in Online Support Application Cross-site scripting in Online Support Application (CVE-2025-14320). Successful exploitation can lead to full system takeover. CVE-2025-14320
- Medium 6.9 Cross-Site Scripting (XSS) in V2Board Cross-site scripting in V2Board (CVE-2026-37503). Confidential information can be exposed externally. CVE-2026-37503