slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,591
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64847). Risk of unauthorized operations or information disclosure. CVE-2025-64847
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64852). Risk of unauthorized operations or information disclosure. CVE-2025-64852
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64853). Risk of unauthorized operations or information disclosure. CVE-2025-64853
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64825). Risk of unauthorized operations or information disclosure. CVE-2025-64825
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64826). Risk of unauthorized operations or information disclosure. CVE-2025-64826
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64827). Risk of unauthorized operations or information disclosure. CVE-2025-64827
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64829). Risk of unauthorized operations or information disclosure. CVE-2025-64829
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64833). Risk of unauthorized operations or information disclosure. CVE-2025-64833
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64839). Risk of unauthorized operations or information disclosure. CVE-2025-64839
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64817). Risk of unauthorized operations or information disclosure. CVE-2025-64817
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64814). Risk of unauthorized operations or information disclosure. CVE-2025-64814
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64823). Risk of unauthorized operations or information disclosure. CVE-2025-64823
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64822). Risk of unauthorized operations or information disclosure. CVE-2025-64822
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64821). Risk of unauthorized operations or information disclosure. CVE-2025-64821
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64820). Risk of unauthorized operations or information disclosure. CVE-2025-64820
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64800). Risk of unauthorized operations or information disclosure. CVE-2025-64800
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64808). Risk of unauthorized operations or information disclosure. CVE-2025-64808
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64804). Risk of unauthorized operations or information disclosure. CVE-2025-64804
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64803). Risk of unauthorized operations or information disclosure. CVE-2025-64803
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64802). Risk of unauthorized operations or information disclosure. CVE-2025-64802
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64801). Risk of unauthorized operations or information disclosure. CVE-2025-64801
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64799). Risk of unauthorized operations or information disclosure. CVE-2025-64799
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64797). Risk of unauthorized operations or information disclosure. CVE-2025-64797
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64796). Risk of unauthorized operations or information disclosure. CVE-2025-64796
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64794). Risk of unauthorized operations or information disclosure. CVE-2025-64794
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64793). Risk of unauthorized operations or information disclosure. CVE-2025-64793
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64792). Risk of unauthorized operations or information disclosure. CVE-2025-64792
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64627). Risk of unauthorized operations or information disclosure. CVE-2025-64627
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64626). Risk of unauthorized operations or information disclosure. CVE-2025-64626
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64789). Risk of unauthorized operations or information disclosure. CVE-2025-64789