slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.1 Cross-Site Scripting (XSS) in Cisco Unified Contact Center Express Cross-site scripting in Cisco Unified Contact Center Express (CVE-2026-20117). Risk of unauthorized operations or information disclosure. CVE-2026-20117
- High 8.1 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21361). Confidential information can be exposed externally. CVE-2026-21361
- High 8.0 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21311). Confidential information can be exposed externally. CVE-2026-21311
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21292). Risk of unauthorized operations or information disclosure. CVE-2026-21292
- High 8.1 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21284). Confidential information can be exposed externally. CVE-2026-21284
- Medium 4.8 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21291). Risk of unauthorized operations or information disclosure. CVE-2026-21291
- High 8.7 Cross-Site Scripting (XSS) in Adobe Commerce Cross-site scripting in Adobe Commerce (CVE-2026-21290). Confidential information can be exposed externally. CVE-2026-21290
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27265). Risk of unauthorized operations or information disclosure. CVE-2026-27265
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27262). Risk of unauthorized operations or information disclosure. CVE-2026-27262
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27266). Risk of unauthorized operations or information disclosure. CVE-2026-27266
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27257). Risk of unauthorized operations or information disclosure. CVE-2026-27257
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27256). Risk of unauthorized operations or information disclosure. CVE-2026-27256
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27255). Risk of unauthorized operations or information disclosure. CVE-2026-27255
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27251). Risk of unauthorized operations or information disclosure. CVE-2026-27251
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27250). Risk of unauthorized operations or information disclosure. CVE-2026-27250
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27249). Risk of unauthorized operations or information disclosure. CVE-2026-27249
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27253). Risk of unauthorized operations or information disclosure. CVE-2026-27253
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27252). Risk of unauthorized operations or information disclosure. CVE-2026-27252
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27254). Risk of unauthorized operations or information disclosure. CVE-2026-27254
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27248). Risk of unauthorized operations or information disclosure. CVE-2026-27248
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27247). Risk of unauthorized operations or information disclosure. CVE-2026-27247
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27244). Risk of unauthorized operations or information disclosure. CVE-2026-27244
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27242). Risk of unauthorized operations or information disclosure. CVE-2026-27242
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27241). Risk of unauthorized operations or information disclosure. CVE-2026-27241
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27236). Risk of unauthorized operations or information disclosure. CVE-2026-27236
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27235). Risk of unauthorized operations or information disclosure. CVE-2026-27235
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27234). Risk of unauthorized operations or information disclosure. CVE-2026-27234
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27237). Risk of unauthorized operations or information disclosure. CVE-2026-27237
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27240). Risk of unauthorized operations or information disclosure. CVE-2026-27240
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27239). Risk of unauthorized operations or information disclosure. CVE-2026-27239