slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8952
SQL Injection4127
Remote Code Execution3108
Path Traversal2163
Privilege Escalation1605
Cross-Site Request Forgery1123
Server-Side Request Forgery895
Authentication Bypass888
Insecure Deserialization809
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,625
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27241). Risk of unauthorized operations or information disclosure. CVE-2026-27241
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27248). Risk of unauthorized operations or information disclosure. CVE-2026-27248
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27234). Risk of unauthorized operations or information disclosure. CVE-2026-27234
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27235). Risk of unauthorized operations or information disclosure. CVE-2026-27235
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27236). Risk of unauthorized operations or information disclosure. CVE-2026-27236
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27240). Risk of unauthorized operations or information disclosure. CVE-2026-27240
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27239). Risk of unauthorized operations or information disclosure. CVE-2026-27239
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27237). Risk of unauthorized operations or information disclosure. CVE-2026-27237
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27233). Risk of unauthorized operations or information disclosure. CVE-2026-27233
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27232). Risk of unauthorized operations or information disclosure. CVE-2026-27232
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27231). Risk of unauthorized operations or information disclosure. CVE-2026-27231
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27230). Risk of unauthorized operations or information disclosure. CVE-2026-27230
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27229). Risk of unauthorized operations or information disclosure. CVE-2026-27229
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27228). Risk of unauthorized operations or information disclosure. CVE-2026-27228
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27223). Risk of unauthorized operations or information disclosure. CVE-2026-27223
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27224). Risk of unauthorized operations or information disclosure. CVE-2026-27224
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27226). Risk of unauthorized operations or information disclosure. CVE-2026-27226
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2026-27225). Risk of unauthorized operations or information disclosure. CVE-2026-27225
- Medium 5.4 Cross-Site Scripting (XSS) in Schneider Electric Modicon M258 Firmware Cross-site scripting in Schneider Electric Modicon M258 Firmware (CVE-2025-13902). Risk of unauthorized operations or information disclosure. CVE-2025-13902
- Medium 6.1 Cross-Site Scripting (XSS) in Sbitsoft Cross-site scripting in Sbitsoft (CVE-2025-40638). Risk of unauthorized operations or information disclosure. CVE-2025-40638
- Medium 6.1 Cross-Site Scripting (XSS) in Humhub Cross-site scripting in Humhub (CVE-2026-29052). Risk of unauthorized operations or information disclosure. CVE-2026-29052
- Medium 6.1 Cross-Site Scripting (XSS) in Cisco Secure Firewall ASA Software Cross-site scripting in Cisco Secure Firewall ASA Software (CVE-2026-20102). Risk of unauthorized operations or information disclosure. CVE-2026-20102
- Medium 6.1 Vulnerability in Cisco Adaptive Security Appliance Software CVE-2026-20070
- Medium 4.3 Vulnerability in Cisco Firepower Threat Defense Software CVE-2026-20069
- Critical 9.0 Vulnerability in org.xwiki.contrib.blog:application-blog-ui CVE-2025-66024
- Medium 6.1 Cross-Site Scripting (XSS) in DOMPurify Cross-site scripting in DOMPurify (CVE-2025-15599). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.2.7 or later. CVE-2025-15599
- Medium 6.1 Cross-Site Scripting (XSS) in Fireware OS Web UI enabled execution Cross-site scripting in Fireware OS Web UI enabled execution (CVE-2026-3343). Risk of unauthorized operations or information disclosure. CVE-2026-3343
- Medium 6.3 Cross-Site Scripting (XSS) in EduAsist Cross-site scripting in EduAsist (CVE-2025-11950). Risk of unauthorized operations or information disclosure. CVE-2025-11950
- Medium 5.4 Cross-Site Scripting (XSS) in PluXml CMS Cross-site scripting in PluXml CMS (CVE-2026-24351). Risk of unauthorized operations or information disclosure. CVE-2026-24351
- Medium 5.4 Cross-Site Scripting (XSS) in PluXml CMS Cross-site scripting in PluXml CMS (CVE-2026-24350). Risk of unauthorized operations or information disclosure. CVE-2026-24350