slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Low 3.5 Cross-Site Scripting (XSS) in 1Panel-dev MaxKB Cross-site scripting in 1Panel-dev MaxKB (CVE-2025-15632). Risk of unauthorized operations or information disclosure. CVE-2025-15632
- Medium 5.4 Cross-Site Scripting (XSS) in NightWolf Penetration Testing Platform Cross-site scripting in NightWolf Penetration Testing Platform (CVE-2026-6179). Risk of unauthorized operations or information disclosure. CVE-2026-6179
- Critical 9.3 Cross-Site Scripting (XSS) in Rukovoditel CRM Cross-site scripting in Rukovoditel CRM (CVE-2026-31845). Confidential information can be exposed externally. CVE-2026-31845
- High 7.1 Cross-Site Scripting (XSS) in Cerato Cross-site scripting in Cerato (CVE-2025-58920). Risk of unauthorized operations or information disclosure. CVE-2025-58920
- Medium 6.1 Cross-Site Scripting (XSS) in Juniper Networks Junos Space Cross-site scripting in Juniper Networks Junos Space (CVE-2026-21904). Risk of unauthorized operations or information disclosure. CVE-2026-21904
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla HikaShop Cross-site scripting in Joomla HikaShop (CVE-2023-54364). Risk of unauthorized operations or information disclosure. CVE-2023-54364
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla iProperty Real Estate Cross-site scripting in Joomla iProperty Real Estate (CVE-2023-54361). Risk of unauthorized operations or information disclosure. CVE-2023-54361
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla JLex Review Cross-site scripting in Joomla JLex Review (CVE-2023-54360). Risk of unauthorized operations or information disclosure. CVE-2023-54360
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla VirtueMart Shopping-Cart Cross-site scripting in Joomla VirtueMart Shopping-Cart (CVE-2023-54362). Risk of unauthorized operations or information disclosure. CVE-2023-54362
- Medium 6.1 Cross-Site Scripting (XSS) in Joomla Solidres Cross-site scripting in Joomla Solidres (CVE-2023-54363). Risk of unauthorized operations or information disclosure. CVE-2023-54363
- Medium 6.1 Cross-Site Scripting (XSS) in WordPress adivaha Travel Plugin Cross-site scripting in WordPress adivaha Travel Plugin (CVE-2023-54358). Risk of unauthorized operations or information disclosure. CVE-2023-54358
- Medium 6.1 Cross-Site Scripting (XSS) in Limesurvey v.6.15.20+251021 Cross-site scripting in Limesurvey v.6.15.20+251021 (CVE-2025-70797). Risk of unauthorized operations or information disclosure. CVE-2025-70797
- Medium 6.1 Cross-Site Scripting (XSS) in Limesurvey Cross-site scripting in Limesurvey (CVE-2025-63238). Risk of unauthorized operations or information disclosure. CVE-2025-63238
- Medium 5.4 Cross-Site Scripting (XSS) in Kiamo Cross-site scripting in Kiamo (CVE-2025-70365). Risk of unauthorized operations or information disclosure. CVE-2025-70365
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Online Shoe Store Cross-site scripting in code-projects Online Shoe Store (CVE-2026-5835). Risk of unauthorized operations or information disclosure. CVE-2026-5835
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Online Shoe Store Cross-site scripting in code-projects Online Shoe Store (CVE-2026-5836). Risk of unauthorized operations or information disclosure. CVE-2026-5836
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Online Shoe Store Cross-site scripting in code-projects Online Shoe Store (CVE-2026-5834). Risk of unauthorized operations or information disclosure. CVE-2026-5834
- Medium 6.4 Cross-Site Scripting (XSS) in OSM – OpenStreetMap (WordPress plugin) Cross-site scripting in OSM – OpenStreetMap (WordPress plugin) (CVE-2026-4429). Risk of unauthorized operations or information disclosure. CVE-2026-4429
- Medium 6.4 Cross-Site Scripting (XSS) in Download Manager (WordPress plugin) Cross-site scripting in Download Manager (WordPress plugin) (CVE-2026-5357). Risk of unauthorized operations or information disclosure. CVE-2026-5357
- Medium 4.4 Cross-Site Scripting (XSS) in Experto Dashboard for WooCommerce (WordPress plugin) Cross-site scripting in Experto Dashboard for WooCommerce (WordPress plugin) (CVE-2026-3574). Risk of unauthorized operations or information disclosure. CVE-2026-3574
- Medium 4.3 Vulnerability in MStore API (WordPress plugin) CVE-2026-3568
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Cross-site scripting in code-projects Simple (CVE-2026-5826). Risk of unauthorized operations or information disclosure. CVE-2026-5826
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5825). Risk of unauthorized operations or information disclosure. CVE-2026-5825
- Medium 6.1 Cross-Site Scripting (XSS) in Sonatype Nexus Repository Manager Cross-site scripting in Sonatype Nexus Repository Manager (CVE-2026-3438). Risk of unauthorized operations or information disclosure. CVE-2026-3438
- Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Sales and Inventory System Cross-site scripting in SourceCodester Sales and Inventory System (CVE-2026-5810). Risk of unauthorized operations or information disclosure. CVE-2026-5810
- Medium 6.4 Cross-Site Scripting (XSS) in Post Blocks & Tools (WordPress plugin) Cross-site scripting in Post Blocks & Tools (WordPress plugin) (CVE-2026-5711). Risk of unauthorized operations or information disclosure. CVE-2026-5711
- Low 3.5 Cross-Site Scripting (XSS) in code-projects Easy Blog Site Cross-site scripting in code-projects Easy Blog Site (CVE-2026-5806). Risk of unauthorized operations or information disclosure. CVE-2026-5806
- Medium 4.3 Cross-Site Scripting (XSS) in openstatusHQ openstatus Cross-site scripting in openstatusHQ openstatus (CVE-2026-5808). Risk of unauthorized operations or information disclosure. CVE-2026-5808
- Medium 5.4 Cross-Site Scripting (XSS) in Hayabusa Cross-site scripting in Hayabusa (CVE-2026-40028). Risk of unauthorized operations or information disclosure. CVE-2026-40028
- Medium 6.4 Cross-Site Scripting (XSS) in Extensions for Leaflet Map (WordPress plugin) Cross-site scripting in Extensions for Leaflet Map (WordPress plugin) (CVE-2026-5451). Risk of unauthorized operations or information disclosure. CVE-2026-5451