slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 6.1 Cross-Site Scripting (XSS) in Clik stats (WordPress plugin) Cross-site scripting in Clik stats (WordPress plugin) (CVE-2025-13513). Risk of unauthorized operations or information disclosure. CVE-2025-13513
- High 7.2 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-11727). Risk of unauthorized operations or information disclosure. CVE-2025-11727
- Medium 6.4 Vulnerability in Nextcloud CVE-2025-59788
- High 7.6 Cross-Site Scripting (XSS) in Rommapp Cross-site scripting in Rommapp (CVE-2025-65027). Data can be tampered with by attackers. Mitigation: upgrade to 4.4.1 or later. CVE-2025-65027
- Medium 5.5 Cross-Site Scripting (XSS) in HCL Technologies Limited HCLTech DRAGON Cross-site scripting in HCL Technologies Limited HCLTech DRAGON (CVE-2025-63401). Data can be tampered with by attackers. CVE-2025-63401
- Critical 9.6 Code Injection in Mermaid diagram renderer CVE-2025-66222
- Medium 6.1 Cross-Site Scripting (XSS) in Avtech Cross-site scripting in Avtech (CVE-2025-57202). Risk of unauthorized operations or information disclosure. CVE-2025-57202
- Medium 6.4 Cross-Site Scripting (XSS) in Autoptimize (WordPress plugin) Cross-site scripting in Autoptimize (WordPress plugin) (CVE-2025-13401). Risk of unauthorized operations or information disclosure. CVE-2025-13401
- Medium 6.4 Cross-Site Scripting (XSS) in CSSIgniter Shortcodes (WordPress plugin) Cross-site scripting in CSSIgniter Shortcodes (WordPress plugin) (CVE-2025-13448). Risk of unauthorized operations or information disclosure. CVE-2025-13448
- Medium 6.1 Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-66459). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.35.3 or later. CVE-2025-66459
- Medium 6.1 Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-66458). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.35.3 or later. CVE-2025-66458
- High 7.6 Cross-Site Scripting (XSS) in Aimeos Cross-site scripting in Aimeos (CVE-2025-66468). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 2021.10.8 or later. CVE-2025-66468
- Medium 5.4 Vulnerability in BigFix SaaS CVE-2025-52622
- Medium 4.8 Cross-Site Scripting (XSS) in Datactive Cross-site scripting in Datactive (CVE-2025-13505). Risk of unauthorized operations or information disclosure. CVE-2025-13505
- Medium 6.4 Cross-Site Scripting (XSS) in Nexter Extension – Site Enhancements Toolkit (WordPress plugin) Cross-site scripting in Nexter Extension – Site Enhancements Toolkit (WordPress plugin) (CVE-2025-13731). Risk of unauthorized operations or information disclosure. CVE-2025-13731
- Medium 6.1 Cross-Site Scripting (XSS) in Idieikon Cross-site scripting in Idieikon (CVE-2025-40700). Risk of unauthorized operations or information disclosure. CVE-2025-40700
- Medium 5.4 Cross-Site Scripting (XSS) in Objectplanet Cross-site scripting in Objectplanet (CVE-2025-13873). Risk of unauthorized operations or information disclosure. CVE-2025-13873
- Medium 6.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13007). Risk of unauthorized operations or information disclosure. CVE-2025-13007
- High 7.2 Cross-Site Scripting (XSS) in Kadence WooCommerce Email Designer (WordPress plugin) Cross-site scripting in Kadence WooCommerce Email Designer (WordPress plugin) (CVE-2025-13387). Risk of unauthorized operations or information disclosure. CVE-2025-13387
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13697). Risk of unauthorized operations or information disclosure. CVE-2025-13697
- Medium 5.4 Cross-Site Scripting (XSS) in @angular/compiler Cross-site scripting in @angular/compiler (CVE-2025-66412). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 21.0.2 or later. CVE-2025-66412
- Medium 4.6 Cross-Site Scripting (XSS) in FileRise Cross-site scripting in FileRise (CVE-2025-66403). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 2.2.3 or later. CVE-2025-66403
- Medium 5.4 Cross-Site Scripting (XSS) in Getgrav Cross-site scripting in Getgrav (CVE-2025-66311). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.11.0-beta.1 or later. CVE-2025-66311
- Medium 5.4 Cross-Site Scripting (XSS) in Getgrav Cross-site scripting in Getgrav (CVE-2025-66312). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.11.0-beta.1 or later. CVE-2025-66312
- Medium 5.4 Cross-Site Scripting (XSS) in Snipe-IT Cross-site scripting in Snipe-IT (CVE-2025-65622). Risk of unauthorized operations or information disclosure. CVE-2025-65622
- Medium 5.4 Cross-Site Scripting (XSS) in Snipe-IT Cross-site scripting in Snipe-IT (CVE-2025-65621). Risk of unauthorized operations or information disclosure. CVE-2025-65621
- Medium 6.5 Cross-Site Scripting (XSS) in Arconix Shortcodes Cross-site scripting in Arconix Shortcodes (CVE-2025-13835). Risk of unauthorized operations or information disclosure. CVE-2025-13835
- Unrated Cross-Site Scripting (XSS) in Sanoma's Clickedu Cross-site scripting in Sanoma's Clickedu (CVE-2025-41070). Risk of unauthorized operations or information disclosure. CVE-2025-41070
- Medium 4.3 Cross-Site Scripting (XSS) in jairiidriss RestaurantWebsite Cross-site scripting in jairiidriss RestaurantWebsite (CVE-2025-13802). Risk of unauthorized operations or information disclosure. CVE-2025-13802
- Low 2.4 Cross-Site Scripting (XSS) in codingWithElias School Management System Cross-site scripting in codingWithElias School Management System (CVE-2025-13795). Risk of unauthorized operations or information disclosure. CVE-2025-13795