slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 4.3 Cross-Site Scripting (XSS) in winston-dsouza Ecommerce-Website Cross-site scripting in winston-dsouza Ecommerce-Website (CVE-2025-13793). Risk of unauthorized operations or information disclosure. CVE-2025-13793
- Low 2.4 Cross-Site Scripting (XSS) in yungifez Skuul School Management System Cross-site scripting in yungifez Skuul School Management System (CVE-2025-13784). Risk of unauthorized operations or information disclosure. CVE-2025-13784
- Medium 5.4 Cross-Site Scripting (XSS) in Tryton sao Cross-site scripting in Tryton sao (CVE-2025-66421). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 7.6.11 or later. CVE-2025-66421
- Medium 5.4 Cross-Site Scripting (XSS) in Tryton sao Cross-site scripting in Tryton sao (CVE-2025-66420). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 7.6.9 or later. CVE-2025-66420
- Medium 6.1 Cross-Site Scripting (XSS) in Retro Cross-site scripting in Retro (CVE-2025-66036). Risk of unauthorized operations or information disclosure. CVE-2025-66036
- High 8.5 Cross-Site Scripting (XSS) in Logpoint Cross-site scripting in Logpoint (CVE-2025-66359). Successful exploitation can lead to full system takeover. CVE-2025-66359
- High 7.2 Cross-Site Scripting (XSS) in Unlimited Elements For Elementor (WordPress plugin) Cross-site scripting in Unlimited Elements For Elementor (WordPress plugin) (CVE-2025-13692). Risk of unauthorized operations or information disclosure. CVE-2025-13692
- Medium 6.1 Vulnerability in Apache CVE-2025-54057
- Medium 6.1 Vulnerability in pretix CVE-2025-13742
- Medium 4.4 Cross-Site Scripting (XSS) in StaffList (WordPress plugin) Cross-site scripting in StaffList (WordPress plugin) (CVE-2025-12185). Risk of unauthorized operations or information disclosure. CVE-2025-12185
- Medium 6.1 Cross-Site Scripting (XSS) in WP Directory Kit (WordPress plugin) Cross-site scripting in WP Directory Kit (WordPress plugin) (CVE-2025-13525). Risk of unauthorized operations or information disclosure. CVE-2025-13525
- Medium 6.1 Cross-Site Scripting (XSS) in Customer Reviews Collector for WooCommerce (WordPress plugin) Cross-site scripting in Customer Reviews Collector for WooCommerce (WordPress plugin) (CVE-2025-12123). Risk of unauthorized operations or information disclosure. CVE-2025-12123
- Medium 6.4 Cross-Site Scripting (XSS) in Simple Folio (WordPress plugin) Cross-site scripting in Simple Folio (WordPress plugin) (CVE-2025-12151). Risk of unauthorized operations or information disclosure. CVE-2025-12151
- Medium 6.4 Cross-Site Scripting (XSS) in Shouty (WordPress plugin) Cross-site scripting in Shouty (WordPress plugin) (CVE-2025-12712). Risk of unauthorized operations or information disclosure. CVE-2025-12712
- Medium 6.4 Cross-Site Scripting (XSS) in Soundslides (WordPress plugin) Cross-site scripting in Soundslides (WordPress plugin) (CVE-2025-12713). Risk of unauthorized operations or information disclosure. CVE-2025-12713
- Medium 6.4 Cross-Site Scripting (XSS) in Google Drive upload and download link (WordPress plugin) Cross-site scripting in Google Drive upload and download link (WordPress plugin) (CVE-2025-12666). Risk of unauthorized operations or information disclosure. CVE-2025-12666
- Medium 6.4 Cross-Site Scripting (XSS) in wp-twitpic (WordPress plugin) Cross-site scripting in wp-twitpic (WordPress plugin) (CVE-2025-12670). Risk of unauthorized operations or information disclosure. CVE-2025-12670
- Medium 6.4 Cross-Site Scripting (XSS) in SortTable Post (WordPress plugin) Cross-site scripting in SortTable Post (WordPress plugin) (CVE-2025-12649). Risk of unauthorized operations or information disclosure. CVE-2025-12649
- Medium 5.4 Cross-Site Scripting (XSS) in Classroomio LMS Cross-site scripting in Classroomio LMS (CVE-2025-65675). Risk of unauthorized operations or information disclosure. CVE-2025-65675
- Medium 5.4 Cross-Site Scripting (XSS) in Classroomio LMS Cross-site scripting in Classroomio LMS (CVE-2025-65676). Risk of unauthorized operations or information disclosure. CVE-2025-65676
- Critical 9.8 Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to… Cross-site scripting reported (CVE-2025-64130). Successful exploitation can lead to full system takeover. CVE-2025-64130
- Medium 6.1 Cross-Site Scripting (XSS) in Houzez (WordPress theme) Cross-site scripting in Houzez (WordPress theme) (CVE-2025-9163). Risk of unauthorized operations or information disclosure. CVE-2025-9163
- Medium 6.1 Cross-Site Scripting (XSS) in REDAXO Cross-site scripting in REDAXO (CVE-2025-66026). Risk of unauthorized operations or information disclosure. CVE-2025-66026
- Medium 6.1 Cross-Site Scripting (XSS) in OWASP Java HTML Sanitizer Cross-site scripting in OWASP Java HTML Sanitizer (CVE-2025-66021). Risk of unauthorized operations or information disclosure. CVE-2025-66021
- Medium 6.5 Cross-Site Scripting (XSS) in Formwork Cross-site scripting in Formwork (CVE-2025-65956). Risk of unauthorized operations or information disclosure. CVE-2025-65956
- Medium 6.1 Cross-Site Scripting (XSS) in Geoserver Cross-site scripting in Geoserver (CVE-2025-21621). Risk of unauthorized operations or information disclosure. CVE-2025-21621
- High 7.9 A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation… Cross-site scripting reported (CVE-2025-40890). Data can be tampered with by attackers. CVE-2025-40890
- High 8.1 HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of… Vulnerability reported (CVE-2025-0248). Confidential information can be exposed externally. CVE-2025-0248
- Medium 6.1 Cross-Site Scripting (XSS) in Job Board by BestWebSoft (WordPress plugin) Cross-site scripting in Job Board by BestWebSoft (WordPress plugin) (CVE-2025-13383). Risk of unauthorized operations or information disclosure. CVE-2025-13383
- Medium 6.4 Cross-Site Scripting (XSS) in Inline frame – Iframe (WordPress plugin) Cross-site scripting in Inline frame – Iframe (WordPress plugin) (CVE-2025-12645). Risk of unauthorized operations or information disclosure. CVE-2025-12645