slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- Medium 5.4 Cross-Site Scripting (XSS) in phpMyFAQ Cross-site scripting in phpMyFAQ (CVE-2025-68951). Risk of unauthorized operations or information disclosure. CVE-2025-68951
- High 7.1 Cross-Site Scripting (XSS) in Content Grid Slider Cross-site scripting in Content Grid Slider (CVE-2025-68879). Risk of unauthorized operations or information disclosure. CVE-2025-68879
- High 7.1 Cross-Site Scripting (XSS) in Advanced Custom CSS Cross-site scripting in Advanced Custom CSS (CVE-2025-68878). Risk of unauthorized operations or information disclosure. CVE-2025-68878
- High 7.1 Cross-Site Scripting (XSS) in Invelity SPS connect Cross-site scripting in Invelity SPS connect (CVE-2025-68876). Risk of unauthorized operations or information disclosure. CVE-2025-68876
- Medium 6.1 Cross-Site Scripting (XSS) in Machsol Cross-site scripting in Machsol (CVE-2025-57462). Risk of unauthorized operations or information disclosure. CVE-2025-57462
- Medium 5.4 Cross-Site Scripting (XSS) in Frappe CRM Cross-site scripting in Frappe CRM (CVE-2025-68928). Risk of unauthorized operations or information disclosure. CVE-2025-68928
- Medium 6.1 Cross-Site Scripting (XSS) in 201206030 novel Cross-site scripting in 201206030 novel (CVE-2025-65442). Risk of unauthorized operations or information disclosure. CVE-2025-65442
- Low 2.4 Cross-Site Scripting (XSS) in Campcodes Complete Online Beauty Parlor Management System Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System (CVE-2025-15188). Risk of unauthorized operations or information disclosure. CVE-2025-15188
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15175). Risk of unauthorized operations or information disclosure. CVE-2025-15175
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15174). Risk of unauthorized operations or information disclosure. CVE-2025-15174
- Medium 5.9 Vulnerability in YaMaps for WordPress Plugin (WordPress plugin) CVE-2025-13958
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15173). Risk of unauthorized operations or information disclosure. CVE-2025-15173
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15172). Risk of unauthorized operations or information disclosure. CVE-2025-15172
- Low 3.5 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15171). Risk of unauthorized operations or information disclosure. CVE-2025-15171
- Medium 4.3 Cross-Site Scripting (XSS) in Advaya Softech GEMS ERP Portal Cross-site scripting in Advaya Softech GEMS ERP Portal (CVE-2025-15170). Risk of unauthorized operations or information disclosure. CVE-2025-15170
- Low 2.4 Cross-Site Scripting (XSS) in rawchen ecms Cross-site scripting in rawchen ecms (CVE-2025-15149). Risk of unauthorized operations or information disclosure. CVE-2025-15149
- Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15146). Risk of unauthorized operations or information disclosure. CVE-2025-15146
- Low 2.4 Cross-Site Scripting (XSS) in SohuTV CacheCloud Cross-site scripting in SohuTV CacheCloud (CVE-2025-15145). Risk of unauthorized operations or information disclosure. CVE-2025-15145
- Medium 4.3 Cross-Site Scripting (XSS) in dayrui XunRuiCMS Cross-site scripting in dayrui XunRuiCMS (CVE-2025-15144). Risk of unauthorized operations or information disclosure. CVE-2025-15144
- Low 3.5 Cross-Site Scripting (XSS) in yourmaileyes MOOC Cross-site scripting in yourmaileyes MOOC (CVE-2025-15134). Risk of unauthorized operations or information disclosure. CVE-2025-15134
- High 7.3 Cross-Site Scripting (XSS) in N8N Cross-site scripting in N8N (CVE-2025-61914). Confidential information can be exposed externally. CVE-2025-61914
- Medium 6.1 Cross-Site Scripting (XSS) in Fluentcms Cross-site scripting in Fluentcms (CVE-2025-67349). Risk of unauthorized operations or information disclosure. CVE-2025-67349
- Medium 5.4 Vulnerability in Hanwhavision CVE-2025-8075
- Medium 5.4 Cross-Site Scripting (XSS) in gitea Cross-site scripting in gitea (CVE-2025-68946). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.20.1 or later. CVE-2025-68946
- Medium 5.4 Cross-Site Scripting (XSS) in Gitea Cross-site scripting in Gitea (CVE-2025-68942). Risk of unauthorized operations or information disclosure. CVE-2025-68942
- Low 3.5 Cross-Site Scripting (XSS) in postmanlabs httpbin Cross-site scripting in postmanlabs httpbin (CVE-2025-15095). Risk of unauthorized operations or information disclosure. CVE-2025-15095
- Medium 4.3 Cross-Site Scripting (XSS) in sunkaifei FlyCMS Cross-site scripting in sunkaifei FlyCMS (CVE-2025-15094). Risk of unauthorized operations or information disclosure. CVE-2025-15094
- Medium 4.3 Cross-Site Scripting (XSS) in sunkaifei FlyCMS Cross-site scripting in sunkaifei FlyCMS (CVE-2025-15093). Risk of unauthorized operations or information disclosure. CVE-2025-15093
- Medium 6.4 Cross-Site Scripting (XSS) in ONLYOFFICE Docs Cross-site scripting in ONLYOFFICE Docs (CVE-2025-68936). Risk of unauthorized operations or information disclosure. CVE-2025-68936
- Medium 6.4 Cross-Site Scripting (XSS) in ONLYOFFICE Docs Cross-site scripting in ONLYOFFICE Docs (CVE-2025-68935). Risk of unauthorized operations or information disclosure. CVE-2025-68935