slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8952
SQL Injection4127
Remote Code Execution3108
Path Traversal2163
Privilege Escalation1605
Cross-Site Request Forgery1123
Server-Side Request Forgery895
Authentication Bypass888
Insecure Deserialization809
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,604
- Medium 6.1 Cross-Site Scripting (XSS) in Pleasanter Cross-site scripting in Pleasanter (CVE-2025-58070). Risk of unauthorized operations or information disclosure. CVE-2025-58070
- Medium 6.4 Cross-Site Scripting (XSS) in Bold Page Builder (WordPress plugin) Cross-site scripting in Bold Page Builder (WordPress plugin) (CVE-2025-7730). Risk of unauthorized operations or information disclosure. CVE-2025-7730
- Medium 6.1 Cross-Site Scripting (XSS) in MCMS Cross-site scripting in MCMS (CVE-2025-60837). Risk of unauthorized operations or information disclosure. CVE-2025-60837
- Medium 6.1 Cross-Site Scripting (XSS) in Liferay Portal Cross-site scripting in Liferay Portal (CVE-2025-62255). Risk of unauthorized operations or information disclosure. CVE-2025-62255
- Medium 6.1 Cross-Site Scripting (XSS) in KeeneticOS Cross-site scripting in KeeneticOS (CVE-2025-56008). Risk of unauthorized operations or information disclosure. CVE-2025-56008
- Medium 6.1 Cross-Site Scripting (XSS) in Vimicro Cross-site scripting in Vimicro (CVE-2025-53701). Risk of unauthorized operations or information disclosure. CVE-2025-53701
- Unrated Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative… Cross-site scripting reported (CVE-2025-1679). Risk of unauthorized operations or information disclosure. CVE-2025-1679
- Medium 6.4 Cross-Site Scripting (XSS) in Beaver Builder Plugin (WordPress plugin) Cross-site scripting in Beaver Builder Plugin (WordPress plugin) (CVE-2025-8427). Risk of unauthorized operations or information disclosure. CVE-2025-8427
- Medium 5.4 Cross-Site Scripting (XSS) in Energy CRM v2025 by Status Tracker Ltd Cross-site scripting in Energy CRM v2025 by Status Tracker Ltd (CVE-2025-40643). Risk of unauthorized operations or information disclosure. CVE-2025-40643
- Medium 4.8 Cross-Site Scripting (XSS) in QuickCMS Cross-site scripting in QuickCMS (CVE-2025-9980). Risk of unauthorized operations or information disclosure. CVE-2025-9980
- Medium 4.8 Cross-Site Scripting (XSS) in QuickCMS Cross-site scripting in QuickCMS (CVE-2025-9981). Risk of unauthorized operations or information disclosure. CVE-2025-9981
- Medium 5.4 Cross-Site Scripting (XSS) in AcBakImzala Cross-site scripting in AcBakImzala (CVE-2025-10727). Risk of unauthorized operations or information disclosure. CVE-2025-10727
- High 7.6 Cross-Site Scripting (XSS) in OBS Cross-site scripting in OBS (CVE-2025-10914). Confidential information can be exposed externally. CVE-2025-10914
- Unrated Cross-Site Scripting (XSS) in VDO.Ninja Cross-site scripting in VDO.Ninja (CVE-2025-62613). Risk of unauthorized operations or information disclosure. CVE-2025-62613
- Medium 4.8 Cross-Site Scripting (XSS) in Liferay Portal Cross-site scripting in Liferay Portal (CVE-2025-62248). Risk of unauthorized operations or information disclosure. CVE-2025-62248
- Unrated Cross-Site Scripting (XSS) in MediaWiki CookieConsent extension Cross-site scripting in MediaWiki CookieConsent extension (CVE-2025-62659). Risk of unauthorized operations or information disclosure. CVE-2025-62659
- Medium 6.5 Cross-Site Scripting (XSS) in Tab Ultimate Cross-site scripting in Tab Ultimate (CVE-2025-62060). Risk of unauthorized operations or information disclosure. CVE-2025-62060
- Medium 6.5 Cross-Site Scripting (XSS) in MDTF Cross-site scripting in MDTF (CVE-2025-62069). Risk of unauthorized operations or information disclosure. CVE-2025-62069
- Medium 6.5 Cross-Site Scripting (XSS) in WP Travel Gutenberg Blocks Cross-site scripting in WP Travel Gutenberg Blocks (CVE-2025-62063). Risk of unauthorized operations or information disclosure. CVE-2025-62063
- Medium 6.5 Cross-Site Scripting (XSS) in Event post Cross-site scripting in Event post (CVE-2025-62042). Risk of unauthorized operations or information disclosure. CVE-2025-62042
- Medium 6.5 Cross-Site Scripting (XSS) in Houzez Theme - Functionality Cross-site scripting in Houzez Theme - Functionality (CVE-2025-62058). Risk of unauthorized operations or information disclosure. CVE-2025-62058
- Medium 6.5 Cross-Site Scripting (XSS) in Pie Calendar Cross-site scripting in Pie Calendar (CVE-2025-62024). Risk of unauthorized operations or information disclosure. CVE-2025-62024
- High 7.1 Cross-Site Scripting (XSS) in Simple Finance Calculator Cross-site scripting in Simple Finance Calculator (CVE-2025-60246). Risk of unauthorized operations or information disclosure. CVE-2025-60246
- High 7.1 Cross-Site Request Forgery (CSRF) in HotelRunner Booking Widget Vulnerability in HotelRunner Booking Widget (CVE-2025-60168). Risk of unauthorized operations or information disclosure. CVE-2025-60168
- Medium 5.9 Cross-Site Scripting (XSS) in WeShare Buttons Cross-site scripting in WeShare Buttons (CVE-2025-60135). Risk of unauthorized operations or information disclosure. CVE-2025-60135
- Medium 5.9 Cross-Site Scripting (XSS) in WP Tesseract Cross-site scripting in WP Tesseract (CVE-2025-60176). Risk of unauthorized operations or information disclosure. CVE-2025-60176
- High 7.1 Cross-Site Request Forgery (CSRF) in Video Blogster Lite Vulnerability in Video Blogster Lite (CVE-2025-60132). Risk of unauthorized operations or information disclosure. CVE-2025-60132
- Medium 5.9 Cross-Site Scripting (XSS) in Werk aan de Muur Cross-site scripting in Werk aan de Muur (CVE-2025-60131). Risk of unauthorized operations or information disclosure. CVE-2025-60131
- Medium 5.9 Cross-Site Scripting (XSS) in Colibri Page Builder Cross-site scripting in Colibri Page Builder (CVE-2025-59593). Risk of unauthorized operations or information disclosure. CVE-2025-59593
- High 7.1 Cross-Site Scripting (XSS) in WorkScout-Core Cross-site scripting in WorkScout-Core (CVE-2025-59571). Risk of unauthorized operations or information disclosure. CVE-2025-59571