slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- Medium 5.9 Cross-Site Scripting (XSS) in Inboxify Sign Up Form Cross-site scripting in Inboxify Sign Up Form (CVE-2025-69008). Risk of unauthorized operations or information disclosure. CVE-2025-69008
- Medium 5.9 Cross-Site Scripting (XSS) in Popping Sidebars and Widgets Light Cross-site scripting in Popping Sidebars and Widgets Light (CVE-2025-69007). Risk of unauthorized operations or information disclosure. CVE-2025-69007
- Medium 5.9 Cross-Site Scripting (XSS) in AM Events Cross-site scripting in AM Events (CVE-2025-69006). Risk of unauthorized operations or information disclosure. CVE-2025-69006
- Medium 6.5 Cross-Site Scripting (XSS) in BWL Pro Voting Manager Cross-site scripting in BWL Pro Voting Manager (CVE-2025-68991). Risk of unauthorized operations or information disclosure. CVE-2025-68991
- Medium 6.5 Cross-Site Scripting (XSS) in BWL Knowledge Base Manager Cross-site scripting in BWL Knowledge Base Manager (CVE-2025-68992). Risk of unauthorized operations or information disclosure. CVE-2025-68992
- Medium 6.5 Cross-Site Scripting (XSS) in DesignThemes Portfolio Addon Cross-site scripting in DesignThemes Portfolio Addon (CVE-2025-68977). Risk of unauthorized operations or information disclosure. CVE-2025-68977
- Medium 6.5 Cross-Site Scripting (XSS) in DesignThemes Core Cross-site scripting in DesignThemes Core (CVE-2025-68978). Risk of unauthorized operations or information disclosure. CVE-2025-68978
- Medium 6.1 ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing… Cross-site scripting reported (CVE-2025-15355). Risk of unauthorized operations or information disclosure. CVE-2025-15355
- Medium 6.1 Vulnerability in Advance WP Query Search Filter (WordPress plugin) CVE-2025-14313
- Medium 6.1 Vulnerability in Advance WP Query Search Filter (WordPress plugin) CVE-2025-14312
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15221). Risk of unauthorized operations or information disclosure. CVE-2025-15221
- Medium 4.3 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15220). Risk of unauthorized operations or information disclosure. CVE-2025-15220
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15219). Risk of unauthorized operations or information disclosure. CVE-2025-15219
- Low 2.4 Cross-Site Scripting (XSS) in Campcodes Park Ticketing System Cross-site scripting in Campcodes Park Ticketing System (CVE-2025-15214). Risk of unauthorized operations or information disclosure. CVE-2025-15214
- Medium 6.5 Cross-Site Scripting (XSS) in JetTabs Cross-site scripting in JetTabs (CVE-2025-68499). Risk of unauthorized operations or information disclosure. CVE-2025-68499
- High 7.1 Cross-Site Scripting (XSS) in Product Puller Cross-site scripting in Product Puller (CVE-2025-23550). Risk of unauthorized operations or information disclosure. CVE-2025-23550
- High 7.1 Cross-Site Scripting (XSS) in Ads24 Lite Cross-site scripting in Ads24 Lite (CVE-2025-23458). Risk of unauthorized operations or information disclosure. CVE-2025-23458
- High 7.1 Cross-Site Scripting (XSS) in Off Page SEO Cross-site scripting in Off Page SEO (CVE-2025-23554). Risk of unauthorized operations or information disclosure. CVE-2025-23554
- High 7.1 Cross-Site Scripting (XSS) in Sleekplan Cross-site scripting in Sleekplan (CVE-2025-23469). Risk of unauthorized operations or information disclosure. CVE-2025-23469
- Medium 6.5 Cross-Site Scripting (XSS) in JetSearch Cross-site scripting in JetSearch (CVE-2025-68504). Risk of unauthorized operations or information disclosure. CVE-2025-68504
- Medium 6.5 Cross-Site Scripting (XSS) in Custom Field Template Cross-site scripting in Custom Field Template (CVE-2025-68607). Risk of unauthorized operations or information disclosure. CVE-2025-68607
- Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15204). Risk of unauthorized operations or information disclosure. CVE-2025-15204
- Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15202). Risk of unauthorized operations or information disclosure. CVE-2025-15202
- Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15203). Risk of unauthorized operations or information disclosure. CVE-2025-15203
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15201). Risk of unauthorized operations or information disclosure. CVE-2025-15201
- Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15200). Risk of unauthorized operations or information disclosure. CVE-2025-15200
- Medium 4.8 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Cross-site scripting reported (CVE-2025-55063). Risk of unauthorized operations or information disclosure. CVE-2025-55063
- Medium 4.8 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Cross-site scripting reported (CVE-2025-55064). Risk of unauthorized operations or information disclosure. CVE-2025-55064
- Medium 4.8 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Cross-site scripting reported (CVE-2025-55062). Risk of unauthorized operations or information disclosure. CVE-2025-55062
- Medium 6.5 Cross-Site Scripting (XSS) in Wp Text Slider Widget Cross-site scripting in Wp Text Slider Widget (CVE-2025-68868). Risk of unauthorized operations or information disclosure. CVE-2025-68868