slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27228). Risk of unauthorized operations or information disclosure. CVE-2026-27228
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27229). Risk of unauthorized operations or information disclosure. CVE-2026-27229
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27230). Risk of unauthorized operations or information disclosure. CVE-2026-27230
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27232). Risk of unauthorized operations or information disclosure. CVE-2026-27232
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27231). Risk of unauthorized operations or information disclosure. CVE-2026-27231
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27233). Risk of unauthorized operations or information disclosure. CVE-2026-27233
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27224). Risk of unauthorized operations or information disclosure. CVE-2026-27224
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27223). Risk of unauthorized operations or information disclosure. CVE-2026-27223
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27225). Risk of unauthorized operations or information disclosure. CVE-2026-27225
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27226). Risk of unauthorized operations or information disclosure. CVE-2026-27226
- Medium 5.4 Cross-Site Scripting (XSS) in Schneider Electric Modicon M258 Firmware Cross-site scripting in Schneider Electric Modicon M258 Firmware (CVE-2025-13902). Risk of unauthorized operations or information disclosure. CVE-2025-13902
- Medium 6.1 Cross-Site Scripting (XSS) in Sbitsoft Cross-site scripting in Sbitsoft (CVE-2025-40638). Risk of unauthorized operations or information disclosure. CVE-2025-40638
- Medium 6.1 Cross-Site Scripting (XSS) in Humhub Cross-site scripting in Humhub (CVE-2026-29052). Risk of unauthorized operations or information disclosure. CVE-2026-29052
- Medium 6.1 Cross-Site Scripting (XSS) in Cisco Secure Firewall ASA Software Cross-site scripting in Cisco Secure Firewall ASA Software (CVE-2026-20102). Risk of unauthorized operations or information disclosure. CVE-2026-20102
- Medium 6.1 Vulnerability in Cisco Adaptive Security Appliance Software CVE-2026-20070
- Medium 4.3 Vulnerability in Cisco Firepower Threat Defense Software CVE-2026-20069
- Critical 9.0 Vulnerability in org.xwiki.contrib.blog:application-blog-ui CVE-2025-66024
- Medium 6.1 Cross-Site Scripting (XSS) in DOMPurify Cross-site scripting in DOMPurify (CVE-2025-15599). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.2.7 or later. CVE-2025-15599
- Medium 6.1 Cross-Site Scripting (XSS) in Fireware OS Web UI enabled execution Cross-site scripting in Fireware OS Web UI enabled execution (CVE-2026-3343). Risk of unauthorized operations or information disclosure. CVE-2026-3343
- Medium 6.3 Cross-Site Scripting (XSS) in EduAsist Cross-site scripting in EduAsist (CVE-2025-11950). Risk of unauthorized operations or information disclosure. CVE-2025-11950
- Medium 5.4 Cross-Site Scripting (XSS) in PluXml CMS Cross-site scripting in PluXml CMS (CVE-2026-24351). Risk of unauthorized operations or information disclosure. CVE-2026-24351
- Medium 5.4 Cross-Site Scripting (XSS) in PluXml CMS Cross-site scripting in PluXml CMS (CVE-2026-24350). Risk of unauthorized operations or information disclosure. CVE-2026-24350
- High 7.6 Cross-Site Scripting (XSS) in E-Commerce Product Cross-site scripting in E-Commerce Product (CVE-2025-14343). Risk of unauthorized operations or information disclosure. CVE-2025-14343
- Medium 6.1 Cross-Site Scripting (XSS) in Arcinfo Cross-site scripting in Arcinfo (CVE-2026-1695). Risk of unauthorized operations or information disclosure. CVE-2026-1695
- Medium 6.1 Cross-Site Scripting (XSS) in Angular Cross-site scripting in Angular (CVE-2026-27970). Risk of unauthorized operations or information disclosure. CVE-2026-27970
- Critical 9.6 Vulnerability in Storybook CVE-2026-27148
- Medium 4.8 Cross-Site Scripting (XSS) in GetSimpleCMS Community Edition Cross-site scripting in GetSimpleCMS Community Edition (CVE-2026-26351). Risk of unauthorized operations or information disclosure. CVE-2026-26351
- Medium 5.4 Cross-Site Scripting (XSS) in Bludit Cross-site scripting in Bludit (CVE-2026-27742). Risk of unauthorized operations or information disclosure. CVE-2026-27742
- Critical 9.3 Vulnerability in Naturalintelligence CVE-2026-25896
- High 8.1 Cross-Site Scripting (XSS) in google-cloud-aiplatform Cross-site scripting in google-cloud-aiplatform (CVE-2026-2472). Confidential information can be exposed externally. Mitigation: upgrade to 1.131.0 or later. CVE-2026-2472