slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,591
- Medium 6.4 Cross-Site Scripting (XSS) in Simple post listing (WordPress plugin) Cross-site scripting in Simple post listing (WordPress plugin) (CVE-2025-12650). Risk of unauthorized operations or information disclosure. CVE-2025-12650
- Medium 6.4 Cross-Site Scripting (XSS) in LJUsers (WordPress plugin) Cross-site scripting in LJUsers (WordPress plugin) (CVE-2025-13839). Risk of unauthorized operations or information disclosure. CVE-2025-13839
- Medium 6.1 Cross-Site Scripting (XSS) in LibreChat Cross-site scripting in LibreChat (CVE-2025-66452). Risk of unauthorized operations or information disclosure. CVE-2025-66452
- Medium 6.1 Cross-Site Scripting (XSS) in SPA-CART CMS Cross-site scripting in SPA-CART CMS (CVE-2024-58304). Risk of unauthorized operations or information disclosure. CVE-2024-58304
- Unrated Cross-Site Scripting (XSS) in XMB Forum Cross-site scripting in XMB Forum (CVE-2024-58292). Risk of unauthorized operations or information disclosure. CVE-2024-58292
- Unrated Cross-Site Scripting (XSS) in CE Phoenix Cross-site scripting in CE Phoenix (CVE-2024-58296). Risk of unauthorized operations or information disclosure. CVE-2024-58296
- Medium 6.1 Cross-Site Scripting (XSS) in HotelDruid Cross-site scripting in HotelDruid (CVE-2025-55816). Risk of unauthorized operations or information disclosure. CVE-2025-55816
- Low 3.5 Cross-Site Scripting (XSS) in yangshare warehouseManager 仓库管理系统 Cross-site scripting in yangshare warehouseManager 仓库管理系统 (CVE-2025-14538). Risk of unauthorized operations or information disclosure. CVE-2025-14538
- High 8.8 Vulnerability in edoc-doctor-appointment-system CVE-2025-66918
- Medium 4.6 Cross-Site Scripting (XSS) in Jetbrains Teamcity Cross-site scripting in Jetbrains Teamcity (CVE-2025-67741). Risk of unauthorized operations or information disclosure. CVE-2025-67741
- Low 3.5 Cross-Site Scripting (XSS) in baowzh hfly Cross-site scripting in baowzh hfly (CVE-2025-14519). Risk of unauthorized operations or information disclosure. CVE-2025-14519
- Medium 6.4 Cross-Site Scripting (XSS) in Widgets for Google Reviews (WordPress plugin) Cross-site scripting in Widgets for Google Reviews (WordPress plugin) (CVE-2025-9436). Risk of unauthorized operations or information disclosure. Exploitable via trustindex. CVE-2025-9436
- High 7.1 Cross-Site Scripting (XSS) in Shopware Cross-site scripting in Shopware (CVE-2025-67648). Data can be tampered with by attackers. CVE-2025-67648
- Medium 6.1 Cross-Site Scripting (XSS) in XWiki Platform Cross-site scripting in XWiki Platform (CVE-2025-66472). Risk of unauthorized operations or information disclosure. CVE-2025-66472
- Medium 5.4 Cross-Site Scripting (XSS) in Chyrp Cross-site scripting in Chyrp (CVE-2024-58285). Risk of unauthorized operations or information disclosure. CVE-2024-58285
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64873). Risk of unauthorized operations or information disclosure. CVE-2025-64873
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64887). Risk of unauthorized operations or information disclosure. CVE-2025-64887
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64881). Risk of unauthorized operations or information disclosure. CVE-2025-64881
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64875). Risk of unauthorized operations or information disclosure. CVE-2025-64875
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64888). Risk of unauthorized operations or information disclosure. CVE-2025-64888
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64863). Risk of unauthorized operations or information disclosure. CVE-2025-64863
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64861). Risk of unauthorized operations or information disclosure. CVE-2025-64861
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64858). Risk of unauthorized operations or information disclosure. CVE-2025-64858
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64857). Risk of unauthorized operations or information disclosure. CVE-2025-64857
- Medium 4.8 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64872). Risk of unauthorized operations or information disclosure. CVE-2025-64872
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64869). Risk of unauthorized operations or information disclosure. CVE-2025-64869
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64847). Risk of unauthorized operations or information disclosure. CVE-2025-64847
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64845). Risk of unauthorized operations or information disclosure. CVE-2025-64845
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64841). Risk of unauthorized operations or information disclosure. CVE-2025-64841
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64840). Risk of unauthorized operations or information disclosure. CVE-2025-64840