slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- High 7.1 Cross-Site Request Forgery (CSRF) in WP sIFR Vulnerability in WP sIFR (CVE-2025-49347). Risk of unauthorized operations or information disclosure. CVE-2025-49347
- Medium 6.1 Vulnerability in SAP NetWeaver Enterprise Portal CVE-2025-42872
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41748). Risk of unauthorized operations or information disclosure. CVE-2025-41748
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41750). Risk of unauthorized operations or information disclosure. CVE-2025-41750
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41749). Risk of unauthorized operations or information disclosure. CVE-2025-41749
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41751). Risk of unauthorized operations or information disclosure. CVE-2025-41751
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41752). Risk of unauthorized operations or information disclosure. CVE-2025-41752
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41746). Risk of unauthorized operations or information disclosure. CVE-2025-41746
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41745). Risk of unauthorized operations or information disclosure. CVE-2025-41745
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41747). Risk of unauthorized operations or information disclosure. CVE-2025-41747
- High 7.1 Cross-Site Scripting (XSS) in Phoenixcontact Cross-site scripting in Phoenixcontact (CVE-2025-41695). Risk of unauthorized operations or information disclosure. CVE-2025-41695
- Medium 6.1 Cross-Site Scripting (XSS) in Tiptap Cross-site scripting in Tiptap (CVE-2025-14284). Risk of unauthorized operations or information disclosure. CVE-2025-14284
- High 7.2 Cross-Site Scripting (XSS) in Login Security, FireWall, Malware removal by CleanTalk (WordPress plugin) Cross-site scripting in Login Security, FireWall, Malware removal by CleanTalk (WordPress plugin) (CVE-2025-13604). Risk of unauthorized operations or information disclosure. CVE-2025-13604
- High 7.1 Cross-Site Scripting (XSS) in Custom Admin Menu (WordPress plugin) Cross-site scripting in Custom Admin Menu (WordPress plugin) (CVE-2025-13071). Risk of unauthorized operations or information disclosure. CVE-2025-13071
- High 7.2 Cross-Site Scripting (XSS) in Social Reviews & Recommendations (WordPress plugin) Cross-site scripting in Social Reviews & Recommendations (WordPress plugin) (CVE-2025-12705). Risk of unauthorized operations or information disclosure. CVE-2025-12705
- Medium 5.9 Vulnerability in WPeMatico RSS Feed Fetcher (WordPress plugin) CVE-2025-13031
- Medium 5.3 Cross-Site Scripting (XSS) in e-BAP Automation Cross-site scripting in e-BAP Automation (CVE-2025-10876). Risk of unauthorized operations or information disclosure. CVE-2025-10876
- Critical 9.6 Cross-Site Scripting (XSS) in Ivanti Endpoint Manager Cross-site scripting in Ivanti Endpoint Manager (CVE-2025-10573). Successful exploitation can lead to full system takeover. CVE-2025-10573
- Critical 9.6 Cross-Site Scripting (XSS) in DeepChat Cross-site scripting in DeepChat (CVE-2025-66481). Successful exploitation can lead to full system takeover. CVE-2025-66481
- Medium 5.4 Cross-Site Scripting (XSS) in IBM WebSphere Application Server Cross-site scripting in IBM WebSphere Application Server (CVE-2025-12635). Risk of unauthorized operations or information disclosure. CVE-2025-12635
- Low 3.5 Cross-Site Scripting (XSS) in R.V.R Cross-site scripting in R.V.R (CVE-2025-65228). Risk of unauthorized operations or information disclosure. CVE-2025-65228
- Medium 4.6 Cross-Site Scripting (XSS) in Lyrion Music Server Cross-site scripting in Lyrion Music Server (CVE-2025-65229). Risk of unauthorized operations or information disclosure. CVE-2025-65229
- Medium 5.4 Cross-Site Scripting (XSS) in Barix Instreamer Cross-site scripting in Barix Instreamer (CVE-2025-65230). Risk of unauthorized operations or information disclosure. CVE-2025-65230
- Medium 6.1 Cross-Site Scripting (XSS) in Barix Instreamer Cross-site scripting in Barix Instreamer (CVE-2025-65231). Risk of unauthorized operations or information disclosure. CVE-2025-65231
- Unrated In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way… Cross-site scripting reported (CVE-2025-42620). Risk of unauthorized operations or information disclosure. CVE-2025-42620
- Low 2.4 Cross-Site Scripting (XSS) in GreenCMS Cross-site scripting in GreenCMS (CVE-2025-14244). Risk of unauthorized operations or information disclosure. CVE-2025-14244
- Low 3.5 Cross-Site Scripting (XSS) in Yealink SIP-T21P E2 Cross-site scripting in Yealink SIP-T21P E2 (CVE-2025-14228). Risk of unauthorized operations or information disclosure. CVE-2025-14228
- High 8.7 Cross-Site Scripting (XSS) in 3Ds Cross-site scripting in 3Ds (CVE-2025-12956). Confidential information can be exposed externally. CVE-2025-12956
- Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Online Banking System Cross-site scripting in SourceCodester Online Banking System (CVE-2025-14221). Risk of unauthorized operations or information disclosure. CVE-2025-14221
- Low 2.4 Cross-Site Scripting (XSS) in Commerce Membership Management System Cross-site scripting in Commerce Membership Management System (CVE-2025-14205). Risk of unauthorized operations or information disclosure. CVE-2025-14205