slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,591
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64593). Risk of unauthorized operations or information disclosure. CVE-2025-64593
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64579). Risk of unauthorized operations or information disclosure. CVE-2025-64579
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64582). Risk of unauthorized operations or information disclosure. CVE-2025-64582
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64583). Risk of unauthorized operations or information disclosure. CVE-2025-64583
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64585). Risk of unauthorized operations or information disclosure. CVE-2025-64585
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64580). Risk of unauthorized operations or information disclosure. CVE-2025-64580
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64581). Risk of unauthorized operations or information disclosure. CVE-2025-64581
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64572). Risk of unauthorized operations or information disclosure. CVE-2025-64572
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64574). Risk of unauthorized operations or information disclosure. CVE-2025-64574
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64569). Risk of unauthorized operations or information disclosure. CVE-2025-64569
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64577). Risk of unauthorized operations or information disclosure. CVE-2025-64577
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64576). Risk of unauthorized operations or information disclosure. CVE-2025-64576
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64575). Risk of unauthorized operations or information disclosure. CVE-2025-64575
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64578). Risk of unauthorized operations or information disclosure. CVE-2025-64578
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64562). Risk of unauthorized operations or information disclosure. CVE-2025-64562
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64564). Risk of unauthorized operations or information disclosure. CVE-2025-64564
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64565). Risk of unauthorized operations or information disclosure. CVE-2025-64565
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64566). Risk of unauthorized operations or information disclosure. CVE-2025-64566
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64563). Risk of unauthorized operations or information disclosure. CVE-2025-64563
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64560). Risk of unauthorized operations or information disclosure. CVE-2025-64560
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64559). Risk of unauthorized operations or information disclosure. CVE-2025-64559
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64556). Risk of unauthorized operations or information disclosure. CVE-2025-64556
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64557). Risk of unauthorized operations or information disclosure. CVE-2025-64557
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64558). Risk of unauthorized operations or information disclosure. CVE-2025-64558
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64553). Risk of unauthorized operations or information disclosure. CVE-2025-64553
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64555). Risk of unauthorized operations or information disclosure. CVE-2025-64555
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64554). Risk of unauthorized operations or information disclosure. CVE-2025-64554
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64546). Risk of unauthorized operations or information disclosure. CVE-2025-64546
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64547). Risk of unauthorized operations or information disclosure. CVE-2025-64547
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64548). Risk of unauthorized operations or information disclosure. CVE-2025-64548