slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67711). Risk of unauthorized operations or information disclosure. CVE-2025-67711
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67704). Risk of unauthorized operations or information disclosure. CVE-2025-67704
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67708). Risk of unauthorized operations or information disclosure. CVE-2025-67708
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67705). Risk of unauthorized operations or information disclosure. CVE-2025-67705
- Medium 6.1 Cross-Site Scripting (XSS) in Linux Windows Cross-site scripting in Linux Windows (CVE-2025-67703). Risk of unauthorized operations or information disclosure. CVE-2025-67703
- High 7.1 Cross-Site Scripting (XSS) in Easy Social Cross-site scripting in Easy Social (CVE-2025-53235). Risk of unauthorized operations or information disclosure. CVE-2025-53235
- High 7.1 Cross-Site Request Forgery (CSRF) in Bloggie Vulnerability in Bloggie (CVE-2025-31054). Risk of unauthorized operations or information disclosure. CVE-2025-31054
- High 7.1 Cross-Site Scripting (XSS) in ZoomSounds Cross-site scripting in ZoomSounds (CVE-2025-47566). Risk of unauthorized operations or information disclosure. CVE-2025-47566
- High 7.1 Cross-Site Scripting (XSS) in Sala Cross-site scripting in Sala (CVE-2025-52739). Risk of unauthorized operations or information disclosure. CVE-2025-52739
- High 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn… Cross-site scripting reported (CVE-2025-50053). Risk of unauthorized operations or information disclosure. CVE-2025-50053
- High 7.1 Cross-Site Scripting (XSS) in ZD Scribd iPaper Cross-site scripting in ZD Scribd iPaper (CVE-2025-23757). Risk of unauthorized operations or information disclosure. CVE-2025-23757
- High 7.1 Cross-Site Scripting (XSS) in ZhinaTwitterWidget Cross-site scripting in ZhinaTwitterWidget (CVE-2025-23719). Risk of unauthorized operations or information disclosure. CVE-2025-23719
- High 7.1 Cross-Site Scripting (XSS) in En Masse Cross-site scripting in En Masse (CVE-2025-23707). Risk of unauthorized operations or information disclosure. CVE-2025-23707
- High 7.1 Cross-Site Scripting (XSS) in Zielke Design Project Gallery Cross-site scripting in Zielke Design Project Gallery (CVE-2025-23705). Risk of unauthorized operations or information disclosure. CVE-2025-23705
- High 7.1 Cross-Site Scripting (XSS) in custom-post-edit Cross-site scripting in custom-post-edit (CVE-2025-23667). Risk of unauthorized operations or information disclosure. CVE-2025-23667
- Medium 5.9 Cross-Site Scripting (XSS) in Cooked Cross-site scripting in Cooked (CVE-2025-62989). Risk of unauthorized operations or information disclosure. CVE-2025-62989
- High 7.1 Cross-Site Scripting (XSS) in LIVE TV Cross-site scripting in LIVE TV (CVE-2025-23608). Risk of unauthorized operations or information disclosure. CVE-2025-23608
- Medium 5.9 Cross-Site Scripting (XSS) in Accessibility Press Cross-site scripting in Accessibility Press (CVE-2025-49355). Risk of unauthorized operations or information disclosure. CVE-2025-49355
- Medium 5.9 Cross-Site Scripting (XSS) in Dashboard Beacon Cross-site scripting in Dashboard Beacon (CVE-2025-49337). Risk of unauthorized operations or information disclosure. CVE-2025-49337
- Medium 5.9 Cross-Site Scripting (XSS) in Behance Portfolio Manager Cross-site scripting in Behance Portfolio Manager (CVE-2025-59135). Risk of unauthorized operations or information disclosure. CVE-2025-59135
- Medium 6.5 Cross-Site Scripting (XSS) in Valenti Engine Cross-site scripting in Valenti Engine (CVE-2025-63021). Risk of unauthorized operations or information disclosure. CVE-2025-63021
- High 8.7 Cross-Site Scripting (XSS) in TrueConf Server Cross-site scripting in TrueConf Server (CVE-2025-66824). Confidential information can be exposed externally. CVE-2025-66824
- Medium 6.5 Cross-Site Scripting (XSS) in Combo Offers WooCommerce Cross-site scripting in Combo Offers WooCommerce (CVE-2025-69088). Risk of unauthorized operations or information disclosure. CVE-2025-69088
- Medium 6.5 Cross-Site Scripting (XSS) in Essential Addons for Elementor Cross-site scripting in Essential Addons for Elementor (CVE-2025-69092). Risk of unauthorized operations or information disclosure. CVE-2025-69092
- Medium 6.5 Cross-Site Scripting (XSS) in Auto Listings Cross-site scripting in Auto Listings (CVE-2025-69089). Risk of unauthorized operations or information disclosure. CVE-2025-69089
- Medium 6.5 Cross-Site Scripting (XSS) in Blog Filter Cross-site scripting in Blog Filter (CVE-2025-69033). Risk of unauthorized operations or information disclosure. CVE-2025-69033
- Medium 6.5 Cross-Site Scripting (XSS) in Web Directory Free Cross-site scripting in Web Directory Free (CVE-2025-69018). Risk of unauthorized operations or information disclosure. CVE-2025-69018
- Medium 6.5 Cross-Site Scripting (XSS) in RestroPress Cross-site scripting in RestroPress (CVE-2025-69017). Risk of unauthorized operations or information disclosure. CVE-2025-69017
- Medium 6.5 Cross-Site Scripting (XSS) in Newsletters Cross-site scripting in Newsletters (CVE-2025-69020). Risk of unauthorized operations or information disclosure. CVE-2025-69020
- Medium 6.5 Cross-Site Scripting (XSS) in FlippingBook Cross-site scripting in FlippingBook (CVE-2025-69019). Risk of unauthorized operations or information disclosure. CVE-2025-69019