slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 5.4 Cross-Site Scripting (XSS) in Vvveb Cross-site scripting in Vvveb (CVE-2026-34429). Risk of unauthorized operations or information disclosure. CVE-2026-34429
- Low 3.5 Cross-Site Scripting (XSS) in Email Encoder (WordPress plugin) Cross-site scripting in Email Encoder (WordPress plugin) (CVE-2024-7083). Risk of unauthorized operations or information disclosure. CVE-2024-7083
- Exploited High Path Traversal in Kentico path-traversal CVE-2025-2749
- Exploited High Cross-Site Scripting (XSS) in Synacor zimbra-collaboration-suite-zcs cross-site scripting in Synacor zimbra-collaboration-suite-zcs (CVE-2025-48700). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. CVE-2025-48700
- Low 3.1 Vulnerability in Stirling-PDF CVE-2026-33436
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13364). Risk of unauthorized operations or information disclosure. CVE-2025-13364
- Medium 6.4 Cross-Site Scripting (XSS) in WP Shortcodes Plugin — Shortcodes Ultimate (WordPress plugin) Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (WordPress plugin) (CVE-2026-3885). Risk of unauthorized operations or information disclosure. CVE-2026-3885
- Medium 6.5 Cross-Site Scripting (XSS) in YouTube Showcase Cross-site scripting in YouTube Showcase (CVE-2025-15636). Risk of unauthorized operations or information disclosure. CVE-2025-15636
- High 8.9 A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality... Cross-site scripting reported (CVE-2025-40899). Data can be tampered with by attackers. CVE-2025-40899
- Medium 5.4 Cross-Site Scripting (XSS) in GROWI Cross-site scripting in GROWI (CVE-2026-26291). Risk of unauthorized operations or information disclosure. CVE-2026-26291
- Medium 4.8 Cross-Site Scripting (XSS) in october/rain Cross-site scripting in october/rain (CVE-2026-25133). Risk of unauthorized operations or information disclosure. Exploitable via media.library.create. Mitigation: upgrade to 3.7.14 or later. CVE-2026-25133
- Medium 4.6 Cross-Site Scripting (XSS) in Docmost Cross-site scripting in Docmost (CVE-2026-33193). Risk of unauthorized operations or information disclosure. CVE-2026-33193
- Medium 5.4 Cross-Site Scripting (XSS) in Chamilo LMS Cross-site scripting in Chamilo LMS (CVE-2026-34161). Risk of unauthorized operations or information disclosure. CVE-2026-34161
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27222). Risk of unauthorized operations or information disclosure. CVE-2026-27222
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-34624). Risk of unauthorized operations or information disclosure. CVE-2026-34624
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-34625). Risk of unauthorized operations or information disclosure. CVE-2026-34625
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-34623). Risk of unauthorized operations or information disclosure. CVE-2026-34623
- Medium 6.1 Cross-Site Scripting (XSS) in /studentms/admin/contact-us.php Cross-site scripting in /studentms/admin/contact-us.php (CVE-2025-65134). Risk of unauthorized operations or information disclosure. CVE-2025-65134
- Medium 6.1 Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to… Vulnerability reported (CVE-2026-5754). Risk of unauthorized operations or information disclosure. CVE-2026-5754
- Medium 6.1 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-34614). Risk of unauthorized operations or information disclosure. CVE-2026-34614
- High 8.7 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-34617). Confidential information can be exposed externally. CVE-2026-34617
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27288). Risk of unauthorized operations or information disclosure. CVE-2026-27288
- Medium 5.4 Cross-Site Scripting (XSS) in DNG SDK Cross-site scripting in DNG SDK (CVE-2026-27258). Risk of unauthorized operations or information disclosure. CVE-2026-27258
- Critical 9.3 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27246). Confidential information can be exposed externally. CVE-2026-27246
- Critical 9.3 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27245). Confidential information can be exposed externally. CVE-2026-27245
- Critical 9.3 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-27243). Confidential information can be exposed externally. CVE-2026-27243
- Medium 6.1 Cross-Site Scripting (XSS) in Adobe macOS Cross-site scripting in Adobe macOS (CVE-2026-21331). Risk of unauthorized operations or information disclosure. CVE-2026-21331
- Medium 5.4 Cross-Site Scripting (XSS) in Fortinet FortiSandbox Cross-site scripting in Fortinet FortiSandbox (CVE-2025-61886). Risk of unauthorized operations or information disclosure. CVE-2025-61886
- Medium 6.9 Cross-Site Scripting (XSS) in Keycloak Cross-site scripting in Keycloak (CVE-2026-37980). Confidential information can be exposed externally. Exploitable via organization.alias. CVE-2026-37980
- Medium 5.4 Cross-Site Scripting (XSS) in Snipe-IT web-based asset management system v8.3.0 to up Cross-site scripting in Snipe-IT web-based asset management system v8.3.0 to up (CVE-2025-63743). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 8.3.2 or later. CVE-2025-63743