slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,602
- Medium 6.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2025-5347). Data can be tampered with by attackers. CVE-2025-5347
- Medium 6.3 Cross-Site Scripting (XSS) in Zohocorp ManageEngine Exchange Reporter Plus Cross-site scripting in Zohocorp ManageEngine Exchange Reporter Plus (CVE-2025-5343). Data can be tampered with by attackers. CVE-2025-5343
- Unrated Cross-Site Scripting (XSS) in URVE Smart Office Cross-site scripting in URVE Smart Office (CVE-2025-10348). Risk of unauthorized operations or information disclosure. CVE-2025-10348
- Unrated Vulnerability in Container suse/manager/5.0/x86_64/server CVE-2025-53883
- High 8.4 Vulnerability in Checkmk's distributed monitoring CVE-2025-39663
- Low 3.5 Vulnerability in NS Maintenance Mode for WP (WordPress plugin) CVE-2025-10636
- Medium 6.4 Cross-Site Scripting (XSS) in Blocksy Companion (WordPress plugin) Cross-site scripting in Blocksy Companion (WordPress plugin) (CVE-2025-12475). Risk of unauthorized operations or information disclosure. CVE-2025-12475
- Medium 6.1 Cross-Site Scripting (XSS) in Drupal CivicTheme Design System Cross-site scripting in Drupal CivicTheme Design System (CVE-2025-12083). Risk of unauthorized operations or information disclosure. CVE-2025-12083
- Low 3.8 Cross-Site Scripting (XSS) in Drupal Umami Analytics Cross-site scripting in Drupal Umami Analytics (CVE-2025-10931). Risk of unauthorized operations or information disclosure. CVE-2025-10931
- Medium 6.1 Cross-Site Scripting (XSS) in Drupal Plausible tracking Cross-site scripting in Drupal Plausible tracking (CVE-2025-10927). Risk of unauthorized operations or information disclosure. CVE-2025-10927
- Medium 6.1 Cross-Site Scripting (XSS) in Drupal JSON Field Cross-site scripting in Drupal JSON Field (CVE-2025-10926). Risk of unauthorized operations or information disclosure. CVE-2025-10926
- Medium 6.1 Cross-Site Scripting (XSS) in LiteSpeed Cache (WordPress plugin) Cross-site scripting in LiteSpeed Cache (WordPress plugin) (CVE-2025-12450). Risk of unauthorized operations or information disclosure. CVE-2025-12450
- Medium 5.9 Cross-Site Scripting (XSS) in Premmerce Product Search for WooCommerce Cross-site scripting in Premmerce Product Search for WooCommerce (CVE-2025-64289). Risk of unauthorized operations or information disclosure. CVE-2025-64289
- Medium 6.5 Cross-Site Scripting (XSS) in Jannah - Extensions Cross-site scripting in Jannah - Extensions (CVE-2025-64208). Risk of unauthorized operations or information disclosure. CVE-2025-64208
- Medium 6.5 Cross-Site Scripting (XSS) in Sahifa Cross-site scripting in Sahifa (CVE-2025-64202). Risk of unauthorized operations or information disclosure. CVE-2025-64202
- Medium 6.5 Cross-Site Scripting (XSS) in SmartMag Cross-site scripting in SmartMag (CVE-2025-64204). Risk of unauthorized operations or information disclosure. CVE-2025-64204
- Medium 6.5 Cross-Site Scripting (XSS) in Rehub Cross-site scripting in Rehub (CVE-2025-64197). Risk of unauthorized operations or information disclosure. CVE-2025-64197
- Medium 5.9 Cross-Site Scripting (XSS) in Email Template Customizer for WooCommerce Cross-site scripting in Email Template Customizer for WooCommerce (CVE-2025-64200). Risk of unauthorized operations or information disclosure. CVE-2025-64200
- High 7.1 Cross-Site Request Forgery (CSRF) in hpb seo plugin for WordPress Vulnerability in hpb seo plugin for WordPress (CVE-2025-60075). Risk of unauthorized operations or information disclosure. CVE-2025-60075
- Medium 6.5 Cross-Site Scripting (XSS) in Eduma Cross-site scripting in Eduma (CVE-2025-64194). Risk of unauthorized operations or information disclosure. CVE-2025-64194
- Medium 5.9 Cross-Site Scripting (XSS) in WooCommerce Cross-site scripting in WooCommerce (CVE-2025-49042). Risk of unauthorized operations or information disclosure. CVE-2025-49042
- Medium 6.4 Cross-Site Scripting (XSS) in Dnnsoftware Cross-site scripting in Dnnsoftware (CVE-2025-64094). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 10.1.1 or later. CVE-2025-64094
- Critical 10.0 Unrestricted File Upload in Dnnsoftware Vulnerability in Dnnsoftware (CVE-2025-64095). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 10.1.1 or later. CVE-2025-64095
- Medium 5.4 Cross-Site Scripting (XSS) in Laravel Sharp Cross-site scripting in Laravel Sharp (CVE-2025-62798). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 9.11.1 or later. CVE-2025-62798
- High 7.2 Cross-Site Scripting (XSS) in Astro Cross-site scripting in Astro (CVE-2025-59837). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 5.13.10 or later. CVE-2025-59837
- Unrated Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34318). Risk of unauthorized operations or information disclosure. CVE-2025-34318
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34309). Risk of unauthorized operations or information disclosure. CVE-2025-34309
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34310). Risk of unauthorized operations or information disclosure. CVE-2025-34310
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34308). Risk of unauthorized operations or information disclosure. CVE-2025-34308
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34315). Risk of unauthorized operations or information disclosure. CVE-2025-34315