slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation Mediawiki - CampaignEvents Extension Cross-site scripting in Wikimedia Foundation Mediawiki - CampaignEvents Extension (CVE-2026-39935). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39935
- Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation Mediawiki - Score Extension Cross-site scripting in Wikimedia Foundation Mediawiki - Score Extension (CVE-2026-39936). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39936
- Medium 6.1 Cross-Site Scripting (XSS) in stdlib Cross-site scripting in stdlib (CVE-2026-32289). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.25.9, 1.26.2 or later. CVE-2026-32289
- Critical 9.0 Cross-Site Scripting (XSS) in github.com/siyuan-note/siyuan/kernel Cross-site scripting in github.com/siyuan-note/siyuan/kernel (CVE-2026-39846). Successful exploitation can lead to full system takeover. Exploitable via nodeIntegration. Mitigation: upgrade to 0.0.0-20260407035653-2f416e5253f1 or later. CVE-2026-39846
- Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation Mediawiki - GlobalWatchlist Extension Cross-site scripting in Wikimedia Foundation Mediawiki - GlobalWatchlist Extension (CVE-2026-39933). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39933
- Medium 6.1 Vulnerability in Mediawiki - Cargo Extension CVE-2026-39841
- Unrated Cross-Site Scripting (XSS) in Wikimedia Foundation MediaWiki - ProofreadPage Extension Cross-site scripting in Wikimedia Foundation MediaWiki - ProofreadPage Extension (CVE-2026-39838). Risk of unauthorized operations or information disclosure. Exploitable via master. CVE-2026-39838
- Medium 5.4 Vulnerability in Mediawiki - Cargo Extension CVE-2026-39837
- Medium 6.1 Vulnerability in Mediawiki - Cargo Extension CVE-2026-39839
- Medium 5.4 Cross-Site Scripting (XSS) in Stock Locations configuration feature Cross-site scripting in Stock Locations configuration feature (CVE-2026-39380). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.4.3 or later. CVE-2026-39380
- Unrated Vulnerability in Wikimedia Foundation Mediawiki - Wikilove Extension CVE-2026-22711
- High 8.1 Cross-Site Scripting (XSS) in ChurchCRM Cross-site scripting in ChurchCRM (CVE-2026-39344). Confidential information can be exposed externally. Mitigation: upgrade to 7.1.0 or later. CVE-2026-39344
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Online Hotel Booking Cross-site scripting in code-projects Online Hotel Booking (CVE-2026-5705). Risk of unauthorized operations or information disclosure. CVE-2026-5705
- Medium 5.4 Cross-Site Scripting (XSS) in OCS Inventory NG Server Cross-site scripting in OCS Inventory NG Server (CVE-2026-22675). Risk of unauthorized operations or information disclosure. Exploitable via User-Agent header. CVE-2026-22675
- Medium 6.1 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2026-35399). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.6.9 or later. CVE-2026-35399
- Medium 5.4 Cross-Site Scripting (XSS) in Webmail Cross-site scripting in Webmail (CVE-2026-35390). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.4.11 or later. CVE-2026-35390
- Medium 4.3 Cross-Site Scripting (XSS) in Cyber-III Student-Management-System Cross-site scripting in Cyber-III Student-Management-System (CVE-2026-5671). Risk of unauthorized operations or information disclosure. CVE-2026-5671
- Medium 5.4 Cross-Site Scripting (XSS) in Feehi CMS Cross-site scripting in Feehi CMS (CVE-2026-31313). Risk of unauthorized operations or information disclosure. CVE-2026-31313
- Medium 5.4 Cross-Site Scripting (XSS) in Bynder Cross-site scripting in Bynder (CVE-2026-31153). Risk of unauthorized operations or information disclosure. CVE-2026-31153
- Medium 4.3 Cross-Site Scripting (XSS) in assafelovic gpt-researcher Cross-site scripting in assafelovic gpt-researcher (CVE-2026-5630). Risk of unauthorized operations or information disclosure. CVE-2026-5630
- Medium 4.3 Cross-Site Scripting (XSS) in assafelovic gpt-researcher Cross-site scripting in assafelovic gpt-researcher (CVE-2026-5625). Risk of unauthorized operations or information disclosure. CVE-2026-5625
- Medium 4.3 Cross-Site Scripting (XSS) in givanz Vvvebjs Cross-site scripting in givanz Vvvebjs (CVE-2026-5615). Risk of unauthorized operations or information disclosure. CVE-2026-5615
- High 8.2 Cross-Site Scripting (XSS) in Ask Expert Script Cross-site scripting in Ask Expert Script (CVE-2019-25676). Confidential information can be exposed externally. CVE-2019-25676
- Low 3.5 Cross-Site Scripting (XSS) in Akaunting Cross-site scripting in Akaunting (CVE-2026-5568). Risk of unauthorized operations or information disclosure. CVE-2026-5568
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5541). Risk of unauthorized operations or information disclosure. CVE-2026-5541
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5542). Risk of unauthorized operations or information disclosure. CVE-2026-5542
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Laundry System Cross-site scripting in code-projects Simple Laundry System (CVE-2026-5539). Risk of unauthorized operations or information disclosure. CVE-2026-5539
- Medium 4.3 Cross-Site Scripting (XSS) in badlogic pi-mono Cross-site scripting in badlogic pi-mono (CVE-2026-5533). Risk of unauthorized operations or information disclosure. CVE-2026-5533
- High 7.2 Cross-Site Scripting (XSS) in MyBB Last User Cross-site scripting in MyBB Last User (CVE-2018-25250). Risk of unauthorized operations or information disclosure. CVE-2018-25250
- Medium 6.1 Cross-Site Scripting (XSS) in MyBB Like Plugin Cross-site scripting in MyBB Like Plugin (CVE-2018-25247). Risk of unauthorized operations or information disclosure. CVE-2018-25247