slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,591
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64551). Risk of unauthorized operations or information disclosure. CVE-2025-64551
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64550). Risk of unauthorized operations or information disclosure. CVE-2025-64550
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64549). Risk of unauthorized operations or information disclosure. CVE-2025-64549
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64545). Risk of unauthorized operations or information disclosure. CVE-2025-64545
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64544). Risk of unauthorized operations or information disclosure. CVE-2025-64544
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64543). Risk of unauthorized operations or information disclosure. CVE-2025-64543
- Medium 5.4 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64541). Risk of unauthorized operations or information disclosure. CVE-2025-64541
- Critical 9.3 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64539). Confidential information can be exposed externally. CVE-2025-64539
- Critical 9.3 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64538). Confidential information can be exposed externally. CVE-2025-64538
- Critical 9.3 Cross-Site Scripting (XSS) in Adobe Experience Manager Cross-site scripting in Adobe Experience Manager (CVE-2025-64537). Confidential information can be exposed externally. CVE-2025-64537
- Medium 5.4 Cross-Site Scripting (XSS) in Jenkins Cross-site scripting in Jenkins (CVE-2025-67641). Risk of unauthorized operations or information disclosure. CVE-2025-67641
- Low 3.5 Cross-Site Scripting (XSS) in GoldenHorn Cross-site scripting in GoldenHorn (CVE-2025-13127). Risk of unauthorized operations or information disclosure. CVE-2025-13127
- High 7.1 Vulnerability in HandL UTM Grabber / Tracker (WordPress plugin) CVE-2025-13072
- High 7.1 Vulnerability in HandL UTM Grabber / Tracker (WordPress plugin) CVE-2025-13073
- Medium 4.3 Cross-Site Scripting (XSS) in WeGIA Cross-site scripting in WeGIA (CVE-2025-67496). Risk of unauthorized operations or information disclosure. CVE-2025-67496
- High 8.0 Cross-Site Scripting (XSS) in ZITADEL Cross-site scripting in ZITADEL (CVE-2025-67495). Confidential information can be exposed externally. CVE-2025-67495
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34425). Risk of unauthorized operations or information disclosure. CVE-2025-34425
- Medium 5.4 Cross-Site Scripting (XSS) in e-BAP Automation Cross-site scripting in e-BAP Automation (CVE-2025-6924). Risk of unauthorized operations or information disclosure. CVE-2025-6924
- Medium 5.4 Cross-Site Scripting (XSS) in UNIS Cross-site scripting in UNIS (CVE-2025-6923). Risk of unauthorized operations or information disclosure. CVE-2025-6923
- High 8.8 Cross-Site Scripting (XSS) in Microsoft Sharepoint Server Cross-site scripting in Microsoft Sharepoint Server (CVE-2025-64672). Successful exploitation can lead to full system takeover. CVE-2025-64672
- Medium 6.1 Cross-Site Scripting (XSS) in Phpipam Cross-site scripting in Phpipam (CVE-2025-61078). Risk of unauthorized operations or information disclosure. CVE-2025-61078
- Medium 5.4 Cross-Site Scripting (XSS) in Fortinet FortiSandbox Cross-site scripting in Fortinet FortiSandbox (CVE-2025-54353). Risk of unauthorized operations or information disclosure. CVE-2025-54353
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34408). Risk of unauthorized operations or information disclosure. CVE-2025-34408
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34407). Risk of unauthorized operations or information disclosure. CVE-2025-34407
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34409). Risk of unauthorized operations or information disclosure. CVE-2025-34409
- Unrated Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers… Vulnerability reported (CVE-2025-34413). Risk of unauthorized operations or information disclosure. CVE-2025-34413
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34406). Risk of unauthorized operations or information disclosure. CVE-2025-34406
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34400). Risk of unauthorized operations or information disclosure. CVE-2025-34400
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34403). Risk of unauthorized operations or information disclosure. CVE-2025-34403
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34401). Risk of unauthorized operations or information disclosure. CVE-2025-34401