slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.1 Cross-Site Scripting (XSS) in Ahsanriaz26Gmailcom Cross-site scripting in Ahsanriaz26Gmailcom (CVE-2026-30567). Risk of unauthorized operations or information disclosure. CVE-2026-30567
- Medium 5.4 Cross-Site Scripting (XSS) in n8n Cross-site scripting in n8n (CVE-2026-56358). Risk of unauthorized operations or information disclosure. Exploitable via NODES_EXCLUDE. Mitigation: upgrade to 1.123.25 or later. CVE-2026-56358
- Unrated A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an… Cross-site scripting reported (CVE-2026-5010). Risk of unauthorized operations or information disclosure. CVE-2026-5010
- Medium 6.1 Vulnerability in github.com/openbao/openbao CVE-2026-33758
- Medium 6.1 Cross-Site Scripting (XSS) in Lyrasis Cross-site scripting in Lyrasis (CVE-2025-61190). Risk of unauthorized operations or information disclosure. CVE-2025-61190
- Medium 5.4 Cross-Site Scripting (XSS) in ByteDance DeerFlow Cross-site scripting in ByteDance DeerFlow (CVE-2026-32859). Risk of unauthorized operations or information disclosure. CVE-2026-32859
- Medium 6.8 Cross-Site Scripting (XSS) in Sentinel LDK Runtime Cross-site scripting in Sentinel LDK Runtime (CVE-2026-3457). Data can be tampered with by attackers. CVE-2026-3457
- Medium 5.4 Cross-Site Scripting (XSS) in MiKa OpenStreetMap Cross-site scripting in MiKa OpenStreetMap (CVE-2026-33559). Risk of unauthorized operations or information disclosure. CVE-2026-33559
- Medium 6.1 Cross-Site Scripting (XSS) in Lightcms Cross-site scripting in Lightcms (CVE-2026-29934). Risk of unauthorized operations or information disclosure. CVE-2026-29934
- Medium 4.8 Cross-Site Scripting (XSS) in Domoticz Cross-site scripting in Domoticz (CVE-2026-1001). Risk of unauthorized operations or information disclosure. CVE-2026-1001
- High 8.7 Cross-Site Scripting (XSS) in Seafile Cross-site scripting in Seafile (CVE-2026-30587). Confidential information can be exposed externally. Mitigation: upgrade to 13.0.17 or later. CVE-2026-30587
- Medium 6.5 Cross-Site Scripting (XSS) in Grid Cross-site scripting in Grid (CVE-2026-24370). Risk of unauthorized operations or information disclosure. CVE-2026-24370
- High 8.2 Cross-Site Scripting (XSS) in Hitachi Infrastructure Analytics Advisor Cross-site scripting in Hitachi Infrastructure Analytics Advisor (CVE-2026-2072). Confidential information can be exposed externally. CVE-2026-2072
- High 8.2 Cross-Site Scripting (XSS) in oRPC Cross-site scripting in oRPC (CVE-2026-33331). Confidential information can be exposed externally. CVE-2026-33331
- Medium 6.1 Cross-Site Scripting (XSS) in actionpack Cross-site scripting in actionpack (CVE-2026-33167). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 8.1.2.1 or later. CVE-2026-33167
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2026-32851). Risk of unauthorized operations or information disclosure. CVE-2026-32851
- Medium 6.1 A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the… Cross-site scripting reported (CVE-2025-52204). Risk of unauthorized operations or information disclosure. CVE-2025-52204
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2026-0609). Risk of unauthorized operations or information disclosure. CVE-2026-0609
- Medium 5.4 Cross-Site Scripting (XSS) in SyncFusion Cross-site scripting in SyncFusion (CVE-2025-63260). Risk of unauthorized operations or information disclosure. CVE-2025-63260
- Medium 4.8 Cross-Site Scripting (XSS) in QuFTP Service Cross-site scripting in QuFTP Service (CVE-2026-22895). Risk of unauthorized operations or information disclosure. CVE-2026-22895
- Unrated Cross-Site Scripting (XSS) in Location Aware Sensor System by Linkit ONE Cross-site scripting in Location Aware Sensor System by Linkit ONE (CVE-2026-32843). Risk of unauthorized operations or information disclosure. CVE-2026-32843
- Medium 6.1 Cross-Site Scripting (XSS) in Zucchetti Axess access control devices Cross-site scripting in Zucchetti Axess access control devices (CVE-2026-30695). Risk of unauthorized operations or information disclosure. CVE-2026-30695
- Exploited High 7.2 Cross-Site Scripting (XSS) in Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting in Synacor Zimbra Collaboration Suite (ZCS) (CVE-2025-66376). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. CVE-2025-66376
- Medium 6.1 Cross-Site Scripting (XSS) in Forcepoint Cross-site scripting in Forcepoint (CVE-2025-2274). Risk of unauthorized operations or information disclosure. CVE-2025-2274
- High 7.2 Cross-Site Scripting (XSS) in ZKTeco ZKAccess Security System Cross-site scripting in ZKTeco ZKAccess Security System (CVE-2016-20032). Risk of unauthorized operations or information disclosure. CVE-2016-20032
- Medium 6.1 Cross-Site Scripting (XSS) in ZKTeco ZKBioSecurity Cross-site scripting in ZKTeco ZKBioSecurity (CVE-2016-20027). Risk of unauthorized operations or information disclosure. CVE-2016-20027
- Medium 6.4 Cross-Site Scripting (XSS) in Vulnogram Cross-site scripting in Vulnogram (CVE-2026-32774). Risk of unauthorized operations or information disclosure. CVE-2026-32774
- High 7.6 Cross-Site Scripting (XSS) in OneUptime Cross-site scripting in OneUptime (CVE-2026-32308). Confidential information can be exposed externally. Mitigation: upgrade to 10.0.23 or later. CVE-2026-32308
- Medium 6.1 Cross-Site Scripting (XSS) in IBM Sterling Partner Engagement Manager Cross-site scripting in IBM Sterling Partner Engagement Manager (CVE-2025-13702). Risk of unauthorized operations or information disclosure. CVE-2025-13702
- Medium 4.6 Cross-Site Scripting (XSS) in action_text-trix Cross-site scripting in action_text-trix (CVE-2026-73426). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.1.17 or later. CVE-2026-73426