slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.4 SQL Injection in Langflow CVE-2026-3346
- Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56537). Risk of unauthorized operations or information disclosure. CVE-2025-56537
- Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56534). Risk of unauthorized operations or information disclosure. CVE-2025-56534
- Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56535). Risk of unauthorized operations or information disclosure. CVE-2025-56535
- Medium 6.1 Cross-Site Scripting (XSS) in Opennebula Cross-site scripting in Opennebula (CVE-2025-56536). Risk of unauthorized operations or information disclosure. CVE-2025-56536
- Medium 6.1 Cross-Site Scripting (XSS) in Wso2 Identity Server Cross-site scripting in Wso2 Identity Server (CVE-2025-10503). Risk of unauthorized operations or information disclosure. CVE-2025-10503
- High 7.2 Cross-Site Scripting (XSS) in GCHQ CyberChef Cross-site scripting in GCHQ CyberChef (CVE-2026-42615). Risk of unauthorized operations or information disclosure. CVE-2026-42615
- Medium 5.4 Cross-Site Scripting (XSS) in phpoffice/phpspreadsheet Cross-site scripting in phpoffice/phpspreadsheet (CVE-2026-40296). Risk of unauthorized operations or information disclosure. Exploitable via General. Mitigation: upgrade to 1.30.4 or later. CVE-2026-40296
- Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-7296). Risk of unauthorized operations or information disclosure. CVE-2026-7296
- Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-7297). Risk of unauthorized operations or information disclosure. CVE-2026-7297
- Medium 6.1 Cross-Site Scripting (XSS) in School Management System by mahmoudai1 Cross-site scripting in School Management System by mahmoudai1 (CVE-2026-37750). Risk of unauthorized operations or information disclosure. CVE-2026-37750
- Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Pizzafy Ecommerce System Cross-site scripting in SourceCodester Pizzafy Ecommerce System (CVE-2026-7295). Risk of unauthorized operations or information disclosure. CVE-2026-7295
- High 8.9 Cross-Site Scripting (XSS) in HTMLy Cross-site scripting in HTMLy (CVE-2026-38949). Confidential information can be exposed externally. CVE-2026-38949
- Low 3.5 Cross-Site Scripting (XSS) in code-projects Coaching Management System Cross-site scripting in code-projects Coaching Management System (CVE-2026-7222). Risk of unauthorized operations or information disclosure. CVE-2026-7222
- Medium 4.3 Cross-Site Scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System Cross-site scripting in SourceCodester Pharmacy Sales and Inventory System (CVE-2026-7200). Risk of unauthorized operations or information disclosure. CVE-2026-7200
- Medium 6.1 A reflected cross-site scripting (XSS) vulnerability exists in diskover-community Cross-site scripting reported (CVE-2026-38935). Risk of unauthorized operations or information disclosure. CVE-2026-38935
- Medium 6.1 A reflected cross-site scripting (XSS) vulnerability exists in diskover-community Cross-site scripting reported (CVE-2026-38936). Risk of unauthorized operations or information disclosure. CVE-2026-38936
- Low 2.4 Cross-Site Scripting (XSS) in BIVOCOM TR321 Cross-site scripting in BIVOCOM TR321 (CVE-2026-6999). Risk of unauthorized operations or information disclosure. CVE-2026-6999
- Medium 6.1 Cross-Site Scripting (XSS) in Cyberpanel Cross-site scripting in Cyberpanel (CVE-2026-41472). Risk of unauthorized operations or information disclosure. Exploitable via POST /api/ai-scanner/callback. CVE-2026-41472
- High 8.1 Vulnerability in @budibase/backend-core CVE-2026-42239
- Medium 6.4 Cross-Site Scripting (XSS) in Royal Elementor Addons (WordPress plugin) Cross-site scripting in Royal Elementor Addons (WordPress plugin) (CVE-2026-5428). Risk of unauthorized operations or information disclosure. CVE-2026-5428
- Medium 6.5 Cross-Site Scripting (XSS) in Rescue Shortcodes Cross-site scripting in Rescue Shortcodes (CVE-2025-62110). Risk of unauthorized operations or information disclosure. CVE-2025-62110
- Medium 5.4 Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an... Cross-site scripting reported (CVE-2026-3007). Risk of unauthorized operations or information disclosure. CVE-2026-3007
- Medium 6.1 Vulnerability in fast-xml-parser CVE-2026-41650
- High 7.1 Path Traversal in Xerte Online Toolkits CVE-2026-34414
- Medium 6.1 Cross-Site Scripting (XSS) in ICEWARP Cross-site scripting in ICEWARP (CVE-2018-25269). Risk of unauthorized operations or information disclosure. CVE-2018-25269
- Medium 6.1 Cross-Site Scripting (XSS) in DeepL Chrome browser extension Cross-site scripting in DeepL Chrome browser extension (CVE-2026-40451). Risk of unauthorized operations or information disclosure. CVE-2026-40451
- Unrated Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that… Cross-site scripting reported (CVE-2026-41456). Risk of unauthorized operations or information disclosure. CVE-2026-41456
- Unrated Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to… Cross-site scripting reported (CVE-2025-10354). Risk of unauthorized operations or information disclosure. CVE-2025-10354
- Unrated Cross-Site Scripting (XSS) in Navigate Content Management System Cross-site scripting in Navigate Content Management System (CVE-2026-3317). Risk of unauthorized operations or information disclosure. CVE-2026-3317