slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.1 Cross-Site Scripting (XSS) in telejson Cross-site scripting in telejson (CVE-2026-47099). Risk of unauthorized operations or information disclosure. Exploitable via postMessage. Mitigation: upgrade to 6.0.0 or later. CVE-2026-47099
- Medium 6.1 Cross-Site Scripting (XSS) in Cmu Cross-site scripting in Cmu (CVE-2026-35466). Risk of unauthorized operations or information disclosure. CVE-2026-35466
- Medium 6.1 Cross-Site Scripting (XSS) in Interzen Consulting S.r.l ZenShare Suite Cross-site scripting in Interzen Consulting S.r.l ZenShare Suite (CVE-2026-30251). Risk of unauthorized operations or information disclosure. CVE-2026-30251
- Medium 6.1 Cross-Site Scripting (XSS) in Interzen Consulting S.r.l ZenShare Suite Cross-site scripting in Interzen Consulting S.r.l ZenShare Suite (CVE-2026-30252). Risk of unauthorized operations or information disclosure. CVE-2026-30252
- Medium 5.4 Cross-Site Scripting (XSS) in hoppscotch Cross-site scripting in hoppscotch (CVE-2026-34848). Risk of unauthorized operations or information disclosure. CVE-2026-34848
- Critical 9.3 Cross-Site Scripting (XSS) in hoppscotch Cross-site scripting in hoppscotch (CVE-2026-34932). Confidential information can be exposed externally. CVE-2026-34932
- Low 3.5 Cross-Site Scripting (XSS) in krayin laravel-crm Cross-site scripting in krayin laravel-crm (CVE-2026-5370). Risk of unauthorized operations or information disclosure. CVE-2026-5370
- High 8.2 Cross-Site Scripting (XSS) in DbGate Cross-site scripting in DbGate (CVE-2026-34725). Successful exploitation can lead to full system takeover. CVE-2026-34725
- Medium 6.1 Cross-Site Scripting (XSS) in Frappe Cross-site scripting in Frappe (CVE-2026-34606). Risk of unauthorized operations or information disclosure. CVE-2026-34606
- Medium 5.3 Vulnerability in ewe CVE-2026-34715
- Medium 6.1 Cross-Site Scripting (XSS) in YesWiki Cross-site scripting in YesWiki (CVE-2026-34598). Risk of unauthorized operations or information disclosure. CVE-2026-34598
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34821). Risk of unauthorized operations or information disclosure. CVE-2026-34821
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34822). Risk of unauthorized operations or information disclosure. CVE-2026-34822
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34823). Risk of unauthorized operations or information disclosure. CVE-2026-34823
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34816). Risk of unauthorized operations or information disclosure. CVE-2026-34816
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34817). Risk of unauthorized operations or information disclosure. CVE-2026-34817
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34818). Risk of unauthorized operations or information disclosure. CVE-2026-34818
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34819). Risk of unauthorized operations or information disclosure. CVE-2026-34819
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34820). Risk of unauthorized operations or information disclosure. CVE-2026-34820
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34812). Risk of unauthorized operations or information disclosure. CVE-2026-34812
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34813). Risk of unauthorized operations or information disclosure. CVE-2026-34813
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34814). Risk of unauthorized operations or information disclosure. CVE-2026-34814
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34815). Risk of unauthorized operations or information disclosure. CVE-2026-34815
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34807). Risk of unauthorized operations or information disclosure. CVE-2026-34807
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34808). Risk of unauthorized operations or information disclosure. CVE-2026-34808
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34809). Risk of unauthorized operations or information disclosure. CVE-2026-34809
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34810). Risk of unauthorized operations or information disclosure. CVE-2026-34810
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34811). Risk of unauthorized operations or information disclosure. CVE-2026-34811
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34803). Risk of unauthorized operations or information disclosure. CVE-2026-34803
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34804). Risk of unauthorized operations or information disclosure. CVE-2026-34804