slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 5.4 Cross-Site Scripting (XSS) in LavaLite CMS Cross-site scripting in LavaLite CMS (CVE-2025-71177). Risk of unauthorized operations or information disclosure. CVE-2025-71177
- Medium 4.7 Cross-Site Scripting (XSS) in Tap&Sign Cross-site scripting in Tap&Sign (CVE-2025-2204). Risk of unauthorized operations or information disclosure. CVE-2025-2204
- High 8.1 Cross-Site Scripting (XSS) in Autodesk Fusion desktop application Cross-site scripting in Autodesk Fusion desktop application (CVE-2026-0535). Confidential information can be exposed externally. CVE-2026-0535
- High 8.1 Cross-Site Scripting (XSS) in Autodesk Fusion desktop application Cross-site scripting in Autodesk Fusion desktop application (CVE-2026-0534). Confidential information can be exposed externally. CVE-2026-0534
- High 8.1 Cross-Site Scripting (XSS) in Autodesk Fusion desktop application Cross-site scripting in Autodesk Fusion desktop application (CVE-2026-0533). Confidential information can be exposed externally. CVE-2026-0533
- Medium 6.5 Cross-Site Scripting (XSS) in Enfold Cross-site scripting in Enfold (CVE-2025-68900). Risk of unauthorized operations or information disclosure. CVE-2025-68900
- Medium 5.5 Cross-Site Scripting (XSS) in Hotel Guest Hotspot Cross-site scripting in Hotel Guest Hotspot (CVE-2025-4763). Risk of unauthorized operations or information disclosure. CVE-2025-4763
- Medium 5.4 Cross-Site Scripting (XSS) in argo-workflows Cross-site scripting in argo-workflows (CVE-2026-23960). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.6.17, 3.7.8 or later. CVE-2026-23960
- Medium 5.4 Cross-Site Scripting (XSS) in GetSimple CMS My SMTP Contact Plugin Cross-site scripting in GetSimple CMS My SMTP Contact Plugin (CVE-2021-47870). Risk of unauthorized operations or information disclosure. CVE-2021-47870
- Medium 5.4 Cross-Site Scripting (XSS) in OpenEMR Cross-site scripting in OpenEMR (CVE-2021-47817). Risk of unauthorized operations or information disclosure. CVE-2021-47817
- Medium 6.1 Cross-Site Scripting (XSS) in hexpm Cross-site scripting in hexpm (CVE-2026-21618). Risk of unauthorized operations or information disclosure. CVE-2026-21618
- High 7.2 Cross-Site Scripting (XSS) in Marky Cross-site scripting in Marky (CVE-2021-47839). Risk of unauthorized operations or information disclosure. CVE-2021-47839
- Medium 6.1 Cross-Site Scripting (XSS) in Markdown Explorer Cross-site scripting in Markdown Explorer (CVE-2021-47836). Risk of unauthorized operations or information disclosure. CVE-2021-47836
- Medium 5.4 Cross-Site Scripting (XSS) in Typesetter CMS Cross-site scripting in Typesetter CMS (CVE-2025-71164). Risk of unauthorized operations or information disclosure. CVE-2025-71164
- Medium 5.4 Cross-Site Scripting (XSS) in Typesetter CMS Cross-site scripting in Typesetter CMS (CVE-2025-71165). Risk of unauthorized operations or information disclosure. CVE-2025-71165
- Medium 5.4 Cross-Site Scripting (XSS) in Typesetter CMS Cross-site scripting in Typesetter CMS (CVE-2025-71166). Risk of unauthorized operations or information disclosure. CVE-2025-71166
- Medium 6.1 Cross-Site Scripting (XSS) in @angular/compiler Cross-site scripting in @angular/compiler (CVE-2026-22610). Risk of unauthorized operations or information disclosure. Exploitable via href. CVE-2026-22610
- High 7.6 Cross-Site Scripting (XSS) in react-router Cross-site scripting in react-router (CVE-2025-59057). Confidential information can be exposed externally. Exploitable via createBrowserRouter. Mitigation: upgrade to 7.9.0 or later. CVE-2025-59057
- High 8.2 Cross-Site Scripting (XSS) in react-router Cross-site scripting in react-router (CVE-2026-21884). Confidential information can be exposed externally. Exploitable via getKey. Mitigation: upgrade to 7.12.0 or later. CVE-2026-21884
- High 8.7 Cross-Site Scripting (XSS) in gitlab Cross-site scripting in gitlab (CVE-2025-9222). Confidential information can be exposed externally. Mitigation: upgrade to 18.5.5, 18.6.3, 18.7.1 or later. CVE-2025-9222
- High 7.1 Cross-Site Scripting (XSS) in Pinpoll Cross-site scripting in Pinpoll (CVE-2025-68889). Risk of unauthorized operations or information disclosure. CVE-2025-68889
- High 7.1 Cross-Site Scripting (XSS) in e-shops Cross-site scripting in e-shops (CVE-2025-68890). Risk of unauthorized operations or information disclosure. CVE-2025-68890
- High 7.1 Cross-Site Scripting (XSS) in WP App Bar Cross-site scripting in WP App Bar (CVE-2025-68891). Risk of unauthorized operations or information disclosure. CVE-2025-68891
- High 7.1 Cross-Site Scripting (XSS) in Scroll rss excerpt Cross-site scripting in Scroll rss excerpt (CVE-2025-68892). Risk of unauthorized operations or information disclosure. CVE-2025-68892
- Medium 5.4 Vulnerability in Easy Media Download CVE-2025-69169
- High 7.1 Cross-Site Scripting (XSS) in PRIMER by chloédigital Cross-site scripting in PRIMER by chloédigital (CVE-2025-68873). Risk of unauthorized operations or information disclosure. CVE-2025-68873
- Medium 6.5 Cross-Site Scripting (XSS) in Effect Maker Cross-site scripting in Effect Maker (CVE-2025-68867). Risk of unauthorized operations or information disclosure. CVE-2025-68867
- High 7.1 Cross-Site Scripting (XSS) in WordPress WP-BusinessDirectory Cross-site scripting in WordPress WP-BusinessDirectory (CVE-2025-68887). Risk of unauthorized operations or information disclosure. CVE-2025-68887
- Medium 6.5 Cross-Site Scripting (XSS) in Flaming Password Reset Cross-site scripting in Flaming Password Reset (CVE-2025-68875). Risk of unauthorized operations or information disclosure. CVE-2025-68875
- High 7.1 Cross-Site Scripting (XSS) in Visitor Stats Widget Cross-site scripting in Visitor Stats Widget (CVE-2025-68874). Risk of unauthorized operations or information disclosure. CVE-2025-68874