slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34406). Risk of unauthorized operations or information disclosure. CVE-2025-34406
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34407). Risk of unauthorized operations or information disclosure. CVE-2025-34407
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34408). Risk of unauthorized operations or information disclosure. CVE-2025-34408
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34402). Risk of unauthorized operations or information disclosure. CVE-2025-34402
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34400). Risk of unauthorized operations or information disclosure. CVE-2025-34400
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34401). Risk of unauthorized operations or information disclosure. CVE-2025-34401
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34404). Risk of unauthorized operations or information disclosure. CVE-2025-34404
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34398). Risk of unauthorized operations or information disclosure. CVE-2025-34398
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34399). Risk of unauthorized operations or information disclosure. CVE-2025-34399
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34403). Risk of unauthorized operations or information disclosure. CVE-2025-34403
- Medium 6.1 Cross-Site Scripting (XSS) in MailEnable Cross-site scripting in MailEnable (CVE-2025-34397). Risk of unauthorized operations or information disclosure. CVE-2025-34397
- Medium 6.1 Cross-Site Scripting (XSS) in Mercurycom Cross-site scripting in Mercurycom (CVE-2025-65289). Risk of unauthorized operations or information disclosure. CVE-2025-65289
- Medium 6.1 Cross-Site Scripting (XSS) in Xinhu Rainrock RockOA Cross-site scripting in Xinhu Rainrock RockOA (CVE-2025-63737). Risk of unauthorized operations or information disclosure. CVE-2025-63737
- Medium 4.8 Cross-Site Scripting (XSS) in i-Educar Cross-site scripting in i-Educar (CVE-2025-9638). Risk of unauthorized operations or information disclosure. CVE-2025-9638
- Medium 5.9 Cross-Site Scripting (XSS) in Rencontre Cross-site scripting in Rencontre (CVE-2025-67558). Risk of unauthorized operations or information disclosure. CVE-2025-67558
- Medium 5.9 Cross-Site Scripting (XSS) in WordPress WP eBay Product Feeds Cross-site scripting in WordPress WP eBay Product Feeds (CVE-2025-67557). Risk of unauthorized operations or information disclosure. CVE-2025-67557
- Medium 5.9 Cross-Site Scripting (XSS) in Advanced FAQ Manager Cross-site scripting in Advanced FAQ Manager (CVE-2025-67556). Risk of unauthorized operations or information disclosure. CVE-2025-67556
- Medium 6.5 Cross-Site Scripting (XSS) in Advanced FAQ Manager Cross-site scripting in Advanced FAQ Manager (CVE-2025-67553). Risk of unauthorized operations or information disclosure. CVE-2025-67553
- Medium 6.5 Cross-Site Scripting (XSS) in Walker Core Cross-site scripting in Walker Core (CVE-2025-67552). Risk of unauthorized operations or information disclosure. CVE-2025-67552
- Medium 6.5 Cross-Site Scripting (XSS) in Wappointment Cross-site scripting in Wappointment (CVE-2025-67551). Risk of unauthorized operations or information disclosure. CVE-2025-67551
- Medium 5.9 Cross-Site Scripting (XSS) in Cookie Notice & Compliance for GDPR / CCPA Cross-site scripting in Cookie Notice & Compliance for GDPR / CCPA (CVE-2025-67554). Risk of unauthorized operations or information disclosure. CVE-2025-67554
- Medium 5.9 Cross-Site Scripting (XSS) in UseStrict's Calendly Embedder Cross-site scripting in UseStrict's Calendly Embedder (CVE-2025-67555). Risk of unauthorized operations or information disclosure. CVE-2025-67555
- Medium 6.5 Cross-Site Scripting (XSS) in oik Cross-site scripting in oik (CVE-2025-67549). Risk of unauthorized operations or information disclosure. CVE-2025-67549
- Medium 6.5 Cross-Site Scripting (XSS) in FireBox Cross-site scripting in FireBox (CVE-2025-67545). Risk of unauthorized operations or information disclosure. CVE-2025-67545
- Medium 6.5 Cross-Site Scripting (XSS) in Donation Thermometer Cross-site scripting in Donation Thermometer (CVE-2025-67550). Risk of unauthorized operations or information disclosure. CVE-2025-67550
- Medium 6.5 Cross-Site Scripting (XSS) in Shopkeeper Extender Cross-site scripting in Shopkeeper Extender (CVE-2025-67544). Risk of unauthorized operations or information disclosure. CVE-2025-67544
- Medium 6.5 Cross-Site Scripting (XSS) in WP-ShowHide Cross-site scripting in WP-ShowHide (CVE-2025-67541). Risk of unauthorized operations or information disclosure. CVE-2025-67541
- Medium 6.5 Cross-Site Scripting (XSS) in Select Core Cross-site scripting in Select Core (CVE-2025-67539). Risk of unauthorized operations or information disclosure. CVE-2025-67539
- Medium 6.5 Cross-Site Scripting (XSS) in Multi-Step Checkout for WooCommerce Cross-site scripting in Multi-Step Checkout for WooCommerce (CVE-2025-67542). Risk of unauthorized operations or information disclosure. CVE-2025-67542
- Medium 6.5 Cross-Site Scripting (XSS) in Essential Widgets Cross-site scripting in Essential Widgets (CVE-2025-67543). Risk of unauthorized operations or information disclosure. CVE-2025-67543