slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,604
- Medium 4.3 A vulnerability has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall… Cross-site scripting reported (CVE-2025-12290). Risk of unauthorized operations or information disclosure. CVE-2025-12290
- Medium 4.3 A flaw has been found in Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1.0… Cross-site scripting reported (CVE-2025-12289). Risk of unauthorized operations or information disclosure. CVE-2025-12289
- Medium 6.4 Cross-Site Scripting (XSS) in OpenVPN Access Server Cross-site scripting in OpenVPN Access Server (CVE-2025-50055). Risk of unauthorized operations or information disclosure. CVE-2025-50055
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Client Details System Cross-site scripting in code-projects Client Details System (CVE-2025-12280). Risk of unauthorized operations or information disclosure. CVE-2025-12280
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Client Details System Cross-site scripting in code-projects Client Details System (CVE-2025-12281). Risk of unauthorized operations or information disclosure. CVE-2025-12281
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Client Details System Cross-site scripting in code-projects Client Details System (CVE-2025-12282). Risk of unauthorized operations or information disclosure. CVE-2025-12282
- Low 2.4 Cross-Site Scripting (XSS) in code-projects Client Details System Cross-site scripting in code-projects Client Details System (CVE-2025-12279). Risk of unauthorized operations or information disclosure. CVE-2025-12279
- Medium 6.1 Cross-Site Scripting (XSS) in SuiteCRM Cross-site scripting in SuiteCRM (CVE-2025-41384). Risk of unauthorized operations or information disclosure. Exploitable via Referer header. CVE-2025-41384
- Low 3.5 Cross-Site Scripting (XSS) in LearnHouse Cross-site scripting in LearnHouse (CVE-2025-12269). Risk of unauthorized operations or information disclosure. CVE-2025-12269
- Medium 4.3 Cross-Site Scripting (XSS) in abhicodebox ModernShop Cross-site scripting in abhicodebox ModernShop (CVE-2025-12267). Risk of unauthorized operations or information disclosure. CVE-2025-12267
- Low 3.5 Cross-Site Scripting (XSS) in Wisencode Cross-site scripting in Wisencode (CVE-2025-12264). Risk of unauthorized operations or information disclosure. CVE-2025-12264
- Low 3.5 Cross-Site Scripting (XSS) in OpenWGA Cross-site scripting in OpenWGA (CVE-2025-12251). Risk of unauthorized operations or information disclosure. CVE-2025-12251
- Unrated Cross-Site Scripting (XSS) in Perx Customer Engagement & Loyalty Platform Cross-site scripting in Perx Customer Engagement & Loyalty Platform (CVE-2025-11682). Risk of unauthorized operations or information disclosure. CVE-2025-11682
- Medium 4.3 Cross-Site Scripting (XSS) in code-projects Simple E-Banking System Cross-site scripting in code-projects Simple E-Banking System (CVE-2025-12244). Risk of unauthorized operations or information disclosure. CVE-2025-12244
- Medium 4.3 Cross-Site Scripting (XSS) in chatwoot Cross-site scripting in chatwoot (CVE-2025-12246). Risk of unauthorized operations or information disclosure. CVE-2025-12246
- Low 2.4 Cross-Site Scripting (XSS) in projectworlds Expense Management System Cross-site scripting in projectworlds Expense Management System (CVE-2025-12231). Risk of unauthorized operations or information disclosure. CVE-2025-12231
- Low 2.4 Cross-Site Scripting (XSS) in projectworlds Expense Management System Cross-site scripting in projectworlds Expense Management System (CVE-2025-12228). Risk of unauthorized operations or information disclosure. CVE-2025-12228
- Low 2.4 Cross-Site Scripting (XSS) in projectworlds Expense Management System Cross-site scripting in projectworlds Expense Management System (CVE-2025-12229). Risk of unauthorized operations or information disclosure. CVE-2025-12229
- Low 2.4 Cross-Site Scripting (XSS) in projectworlds Expense Management System Cross-site scripting in projectworlds Expense Management System (CVE-2025-12230). Risk of unauthorized operations or information disclosure. CVE-2025-12230
- Low 3.5 Cross-Site Scripting (XSS) in projectworlds Gate Pass Management System Cross-site scripting in projectworlds Gate Pass Management System (CVE-2025-12227). Risk of unauthorized operations or information disclosure. CVE-2025-12227
- Low 3.5 Cross-Site Scripting (XSS) in Iqbolshoh php-business-website Cross-site scripting in Iqbolshoh php-business-website (CVE-2025-12224). Risk of unauthorized operations or information disclosure. CVE-2025-12224
- Medium 6.5 Cross-Site Scripting (XSS) in Ultimate Addons for WPBakery Page Builder Cross-site scripting in Ultimate Addons for WPBakery Page Builder (CVE-2025-48088). Risk of unauthorized operations or information disclosure. CVE-2025-48088
- Medium 5.9 Cross-Site Scripting (XSS) in Dynamic User Directory Cross-site scripting in Dynamic User Directory (CVE-2025-62982). Risk of unauthorized operations or information disclosure. CVE-2025-62982
- High 7.1 Cross-Site Request Forgery (CSRF) in FanBridge signup Vulnerability in FanBridge signup (CVE-2025-62986). Risk of unauthorized operations or information disclosure. CVE-2025-62986
- Medium 6.5 Cross-Site Scripting (XSS) in Simple Pull Quote Cross-site scripting in Simple Pull Quote (CVE-2025-62985). Risk of unauthorized operations or information disclosure. CVE-2025-62985
- Medium 6.5 Cross-Site Scripting (XSS) in WP AdCenter Cross-site scripting in WP AdCenter (CVE-2025-62984). Risk of unauthorized operations or information disclosure. CVE-2025-62984
- Medium 6.5 Cross-Site Scripting (XSS) in Posts By Tag Cross-site scripting in Posts By Tag (CVE-2025-62983). Risk of unauthorized operations or information disclosure. CVE-2025-62983
- Medium 6.5 Cross-Site Scripting (XSS) in Builderall Builder for WordPress Cross-site scripting in Builderall Builder for WordPress (CVE-2025-62987). Risk of unauthorized operations or information disclosure. CVE-2025-62987
- Medium 6.5 Cross-Site Scripting (XSS) in Headline Analyzer Cross-site scripting in Headline Analyzer (CVE-2025-62974). Risk of unauthorized operations or information disclosure. CVE-2025-62974
- Medium 6.5 Cross-Site Scripting (XSS) in DirectoryPress Cross-site scripting in DirectoryPress (CVE-2025-62967). Risk of unauthorized operations or information disclosure. CVE-2025-62967