slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,602
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34310). Risk of unauthorized operations or information disclosure. CVE-2025-34310
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34315). Risk of unauthorized operations or information disclosure. CVE-2025-34315
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34316). Risk of unauthorized operations or information disclosure. CVE-2025-34316
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34306). Risk of unauthorized operations or information disclosure. CVE-2025-34306
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34305). Risk of unauthorized operations or information disclosure. Exploitable via POST /cgi-bin/wakeonlan.cgi. CVE-2025-34305
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34302). Risk of unauthorized operations or information disclosure. CVE-2025-34302
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34303). Risk of unauthorized operations or information disclosure. CVE-2025-34303
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34301). Risk of unauthorized operations or information disclosure. CVE-2025-34301
- Medium 5.4 Cross-Site Scripting (XSS) in IPFire Cross-site scripting in IPFire (CVE-2025-34307). Risk of unauthorized operations or information disclosure. CVE-2025-34307
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects E-Commerce Website Cross-site scripting in code-projects E-Commerce Website (CVE-2025-12335). Risk of unauthorized operations or information disclosure. CVE-2025-12335
- Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Student Grades Management System Cross-site scripting in SourceCodester Student Grades Management System (CVE-2025-12332). Risk of unauthorized operations or information disclosure. CVE-2025-12332
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects E-Commerce Website Cross-site scripting in code-projects E-Commerce Website (CVE-2025-12334). Risk of unauthorized operations or information disclosure. CVE-2025-12334
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects E-Commerce Website Cross-site scripting in code-projects E-Commerce Website (CVE-2025-12333). Risk of unauthorized operations or information disclosure. CVE-2025-12333
- Low 2.4 Cross-Site Scripting (XSS) in Willow CMS Cross-site scripting in Willow CMS (CVE-2025-12330). Risk of unauthorized operations or information disclosure. CVE-2025-12330
- Medium 6.8 eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking Cross-site scripting reported (CVE-2025-62793). Confidential information can be exposed externally. CVE-2025-62793
- Medium 5.4 Cross-Site Scripting (XSS) in Liferay Portal Cross-site scripting in Liferay Portal (CVE-2025-62263). Risk of unauthorized operations or information disclosure. CVE-2025-62263
- High 8.2 Vulnerability in Pi Hole Web Interface CVE-2025-59151
- Low 2.4 Cross-Site Scripting (XSS) in PHPGurukul Curfew e-Pass Management System Cross-site scripting in PHPGurukul Curfew e-Pass Management System (CVE-2025-12311). Risk of unauthorized operations or information disclosure. CVE-2025-12311
- Low 2.4 Cross-Site Scripting (XSS) in PHPGurukul Curfew e-Pass Management System Cross-site scripting in PHPGurukul Curfew e-Pass Management System (CVE-2025-12312). Risk of unauthorized operations or information disclosure. CVE-2025-12312
- Medium 6.1 Cross-Site Scripting (XSS) in Pi Hole Web Interface Cross-site scripting in Pi Hole Web Interface (CVE-2025-53533). Risk of unauthorized operations or information disclosure. CVE-2025-53533
- Medium 5.4 Cross-Site Scripting (XSS) in Pi Hole Web Interface Cross-site scripting in Pi Hole Web Interface (CVE-2025-32785). Risk of unauthorized operations or information disclosure. CVE-2025-32785
- Medium 6.4 Cross-Site Scripting (XSS) in IBM QRadar SIEM Cross-site scripting in IBM QRadar SIEM (CVE-2025-36170). Risk of unauthorized operations or information disclosure. CVE-2025-36170
- Medium 6.4 Cross-Site Scripting (XSS) in IBM QRadar SIEM Cross-site scripting in IBM QRadar SIEM (CVE-2025-36138). Risk of unauthorized operations or information disclosure. CVE-2025-36138
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Food Ordering System Cross-site scripting in code-projects Simple Food Ordering System (CVE-2025-12302). Risk of unauthorized operations or information disclosure. CVE-2025-12302
- Low 2.4 Cross-Site Scripting (XSS) in PHPGurukul Curfew e-Pass Management System Cross-site scripting in PHPGurukul Curfew e-Pass Management System (CVE-2025-12303). Risk of unauthorized operations or information disclosure. CVE-2025-12303
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Food Ordering System Cross-site scripting in code-projects Simple Food Ordering System (CVE-2025-12300). Risk of unauthorized operations or information disclosure. CVE-2025-12300
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Food Ordering System Cross-site scripting in code-projects Simple Food Ordering System (CVE-2025-12298). Risk of unauthorized operations or information disclosure. CVE-2025-12298
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple Food Ordering System Cross-site scripting in code-projects Simple Food Ordering System (CVE-2025-12299). Risk of unauthorized operations or information disclosure. CVE-2025-12299
- Medium 6.2 Cross-Site Scripting (XSS) in Infra Monitoring Cross-site scripting in Infra Monitoring (CVE-2025-10023). Confidential information can be exposed externally. CVE-2025-10023
- Medium 4.3 A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall… Cross-site scripting reported (CVE-2025-12290). Risk of unauthorized operations or information disclosure. CVE-2025-12290