slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 5.4 Cross-Site Scripting (XSS) in Revive Adserver Cross-site scripting in Revive Adserver (CVE-2025-52668). Risk of unauthorized operations or information disclosure. CVE-2025-52668
- Medium 4.8 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62731). Risk of unauthorized operations or information disclosure. CVE-2025-62731
- Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62295). Risk of unauthorized operations or information disclosure. CVE-2025-62295
- Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62297). Risk of unauthorized operations or information disclosure. CVE-2025-62297
- Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62729). Risk of unauthorized operations or information disclosure. CVE-2025-62729
- Medium 5.4 Cross-Site Scripting (XSS) in SOPlanning Cross-site scripting in SOPlanning (CVE-2025-62296). Risk of unauthorized operations or information disclosure. CVE-2025-62296
- Medium 6.1 Cross-Site Scripting (XSS) in Kaspersky Endpoint Security for Linux Cross-site scripting in Kaspersky Endpoint Security for Linux (CVE-2025-64984). Risk of unauthorized operations or information disclosure. CVE-2025-64984
- Low 3.5 Cross-Site Scripting (XSS) in SourceCodester Online Shop Project Cross-site scripting in SourceCodester Online Shop Project (CVE-2025-13450). Risk of unauthorized operations or information disclosure. CVE-2025-13450
- High 7.2 Cross-Site Scripting (XSS) in Pyxis Signage Cross-site scripting in Pyxis Signage (CVE-2025-0643). Successful exploitation can lead to full system takeover. CVE-2025-0643
- Low 2.4 Cross-Site Scripting (XSS) in Public Knowledge Project omp and ojs Cross-site scripting in Public Knowledge Project omp and ojs (CVE-2025-13469). Risk of unauthorized operations or information disclosure. CVE-2025-13469
- Unrated Cross-Site Scripting (XSS) in uCMDB Cross-site scripting in uCMDB (CVE-2025-11884). Risk of unauthorized operations or information disclosure. CVE-2025-11884
- Low 3.5 Cross-Site Scripting (XSS) in icret EasyImages Cross-site scripting in icret EasyImages (CVE-2025-13415). Risk of unauthorized operations or information disclosure. CVE-2025-13415
- Low 2.4 Cross-Site Scripting (XSS) in Campcodes Retro Basketball Shoes Online Store Cross-site scripting in Campcodes Retro Basketball Shoes Online Store (CVE-2025-13412). Risk of unauthorized operations or information disclosure. CVE-2025-13412
- High 8.1 Vulnerability in Homarr CVE-2025-64759
- Unrated Cross-Site Scripting (XSS) in Lookyloo Cross-site scripting in Lookyloo (CVE-2025-65095). Risk of unauthorized operations or information disclosure. CVE-2025-65095
- Medium 6.1 Code Injection in esm.sh CVE-2025-65026
- High 7.1 Vulnerability in Astro CVE-2025-64764
- Medium 5.4 Cross-Site Scripting (XSS) in Astro Cross-site scripting in Astro (CVE-2025-65019). Risk of unauthorized operations or information disclosure. CVE-2025-65019
- Medium 5.4 Cross-Site Scripting (XSS) in StarCities Cross-site scripting in StarCities (CVE-2025-11963). Risk of unauthorized operations or information disclosure. CVE-2025-11963
- Medium 4.7 Vulnerability in Fortinet FortiADC CVE-2025-58412
- High 7.2 Cross-Site Scripting (XSS) in GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin) Cross-site scripting in GiveWP – Donation Plugin and Fundraising Platform (WordPress plugin) (CVE-2025-13206). Risk of unauthorized operations or information disclosure. CVE-2025-13206
- High 7.2 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-12484). Risk of unauthorized operations or information disclosure. CVE-2025-12484
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13054). Risk of unauthorized operations or information disclosure. CVE-2025-13054
- Medium 6.4 Cross-Site Scripting (XSS) in FunnelKit – Funnel Builder for WooCommerce Checkout (WordPress plugin) Cross-site scripting in FunnelKit – Funnel Builder for WooCommerce Checkout (WordPress plugin) (CVE-2025-12878). Risk of unauthorized operations or information disclosure. Exploitable via wfop_phone. CVE-2025-12878
- Medium 6.4 Cross-Site Scripting (XSS) in Pet-Manager – Petfinder (WordPress plugin) Cross-site scripting in Pet-Manager – Petfinder (WordPress plugin) (CVE-2025-12710). Risk of unauthorized operations or information disclosure. CVE-2025-12710
- Medium 6.4 Cross-Site Scripting (XSS) in Royal Elementor Addons and Templates (WordPress plugin) Cross-site scripting in Royal Elementor Addons and Templates (WordPress plugin) (CVE-2025-6251). Risk of unauthorized operations or information disclosure. CVE-2025-6251
- Medium 6.2 Cross-Site Scripting (XSS) in LibreNMS Cross-site scripting in LibreNMS (CVE-2025-65013). Confidential information can be exposed externally. CVE-2025-65013
- Medium 6.8 Cross-Site Scripting (XSS) in SourceCodester Student Grades Management System Cross-site scripting in SourceCodester Student Grades Management System (CVE-2025-63892). Successful exploitation can lead to full system takeover. CVE-2025-63892
- Medium 4.8 Cross-Site Scripting (XSS) in Windu CMS Cross-site scripting in Windu CMS (CVE-2025-59117). Risk of unauthorized operations or information disclosure. CVE-2025-59117
- Medium 5.4 Cross-Site Scripting (XSS) in Windu CMS Cross-site scripting in Windu CMS (CVE-2025-59115). Risk of unauthorized operations or information disclosure. CVE-2025-59115