slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,588
- High 7.6 Cross-Site Scripting (XSS) in Aidango Cross-site scripting in Aidango (CVE-2025-2307). Data can be tampered with by attackers. CVE-2025-2307
- High 7.6 Cross-Site Scripting (XSS) in Titarus Cross-site scripting in Titarus (CVE-2025-2405). Data can be tampered with by attackers. CVE-2025-2405
- High 7.6 Cross-Site Scripting (XSS) in Trizbi Cross-site scripting in Trizbi (CVE-2025-2406). Data can be tampered with by attackers. CVE-2025-2406
- Medium 6.4 Cross-Site Scripting (XSS) in ONLYOFFICE Docs Cross-site scripting in ONLYOFFICE Docs (CVE-2025-68917). Risk of unauthorized operations or information disclosure. CVE-2025-68917
- Medium 5.5 Cross-Site Scripting (XSS) in Riello UPS NetMan 208 Application Cross-site scripting in Riello UPS NetMan 208 Application (CVE-2025-68915). Risk of unauthorized operations or information disclosure. CVE-2025-68915
- Medium 5.4 Cross-Site Scripting (XSS) in Specto CM Cross-site scripting in Specto CM (CVE-2025-2154). Risk of unauthorized operations or information disclosure. CVE-2025-2154
- Medium 6.5 Cross-Site Scripting (XSS) in Post Grid and Gutenberg Blocks Cross-site scripting in Post Grid and Gutenberg Blocks (CVE-2025-68605). Risk of unauthorized operations or information disclosure. CVE-2025-68605
- Medium 6.5 Cross-Site Scripting (XSS) in Jobs for WordPress Cross-site scripting in Jobs for WordPress (CVE-2025-68597). Risk of unauthorized operations or information disclosure. CVE-2025-68597
- Medium 6.5 Cross-Site Scripting (XSS) in Page Builder Cross-site scripting in Page Builder (CVE-2025-68598). Risk of unauthorized operations or information disclosure. CVE-2025-68598
- Medium 6.5 Cross-Site Scripting (XSS) in YouTube Embed Cross-site scripting in YouTube Embed (CVE-2025-68599). Risk of unauthorized operations or information disclosure. CVE-2025-68599
- Medium 5.9 Cross-Site Scripting (XSS) in WPBakery Visual Composer WHMCS Elements Cross-site scripting in WPBakery Visual Composer WHMCS Elements (CVE-2025-68574). Risk of unauthorized operations or information disclosure. CVE-2025-68574
- Medium 5.9 Cross-Site Scripting (XSS) in My auctions allegro Cross-site scripting in My auctions allegro (CVE-2025-68566). Risk of unauthorized operations or information disclosure. CVE-2025-68566
- Medium 6.5 Cross-Site Scripting (XSS) in Academy LMS Cross-site scripting in Academy LMS (CVE-2025-68527). Risk of unauthorized operations or information disclosure. CVE-2025-68527
- Medium 6.5 Cross-Site Scripting (XSS) in Free Shipping Bar Cross-site scripting in Free Shipping Bar (CVE-2025-68528). Risk of unauthorized operations or information disclosure. CVE-2025-68528
- Medium 6.5 Cross-Site Scripting (XSS) in WC Builder Cross-site scripting in WC Builder (CVE-2025-68533). Risk of unauthorized operations or information disclosure. CVE-2025-68533
- Medium 6.5 Cross-Site Scripting (XSS) in ModelTheme Addons for WPBakery and Elementor Cross-site scripting in ModelTheme Addons for WPBakery and Elementor (CVE-2025-68532). Risk of unauthorized operations or information disclosure. CVE-2025-68532
- Medium 5.9 Cross-Site Scripting (XSS) in Category Icon Cross-site scripting in Category Icon (CVE-2025-68525). Risk of unauthorized operations or information disclosure. CVE-2025-68525
- Medium 6.5 Cross-Site Scripting (XSS) in Real 3D FlipBook Cross-site scripting in Real 3D FlipBook (CVE-2025-68512). Risk of unauthorized operations or information disclosure. CVE-2025-68512
- Medium 6.5 Cross-Site Scripting (XSS) in Bold Timeline Lite Cross-site scripting in Bold Timeline Lite (CVE-2025-68513). Risk of unauthorized operations or information disclosure. CVE-2025-68513
- Medium 5.9 Cross-Site Scripting (XSS) in Astra Widgets Cross-site scripting in Astra Widgets (CVE-2025-68497). Risk of unauthorized operations or information disclosure. CVE-2025-68497
- Medium 5.9 Cross-Site Scripting (XSS) in Google AdSense for Responsive Design – GARD Cross-site scripting in Google AdSense for Responsive Design – GARD (CVE-2025-67632). Risk of unauthorized operations or information disclosure. CVE-2025-67632
- Medium 5.9 Cross-Site Scripting (XSS) in WH Tweaks Cross-site scripting in WH Tweaks (CVE-2025-67630). Risk of unauthorized operations or information disclosure. CVE-2025-67630
- Medium 5.9 Cross-Site Scripting (XSS) in Basticom Framework Cross-site scripting in Basticom Framework (CVE-2025-67629). Risk of unauthorized operations or information disclosure. CVE-2025-67629
- Medium 5.9 Cross-Site Scripting (XSS) in Gift Hunt Cross-site scripting in Gift Hunt (CVE-2025-67631). Risk of unauthorized operations or information disclosure. CVE-2025-67631
- Medium 5.9 Cross-Site Scripting (XSS) in Greenhouse Job Board Cross-site scripting in Greenhouse Job Board (CVE-2025-67633). Risk of unauthorized operations or information disclosure. CVE-2025-67633
- Medium 5.9 Cross-Site Scripting (XSS) in Draft Notify Cross-site scripting in Draft Notify (CVE-2025-67627). Risk of unauthorized operations or information disclosure. CVE-2025-67627
- High 7.1 Cross-Site Request Forgery (CSRF) in Evergreen Post Tweeter Vulnerability in Evergreen Post Tweeter (CVE-2025-67622). Risk of unauthorized operations or information disclosure. CVE-2025-67622
- Medium 5.9 Cross-Site Scripting (XSS) in Review Disclaimer Cross-site scripting in Review Disclaimer (CVE-2025-67628). Risk of unauthorized operations or information disclosure. CVE-2025-67628
- High 8.2 Cross-Site Scripting (XSS) in Hitachi Infrastructure Analytics Advisor Cross-site scripting in Hitachi Infrastructure Analytics Advisor (CVE-2025-66444). Confidential information can be exposed externally. CVE-2025-66444
- Low 3.5 Cross-Site Scripting (XSS) in code-projects Student Information System Cross-site scripting in code-projects Student Information System (CVE-2025-15052). Risk of unauthorized operations or information disclosure. CVE-2025-15052