slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8952
SQL Injection4127
Remote Code Execution3108
Path Traversal2163
Privilege Escalation1605
Cross-Site Request Forgery1123
Server-Side Request Forgery895
Authentication Bypass888
Insecure Deserialization809
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,608
- Medium 6.4 Cross-Site Scripting (XSS) in Redirection for Contact Form (WordPress plugin) Cross-site scripting in Redirection for Contact Form (WordPress plugin) (CVE-2025-9562). Risk of unauthorized operations or information disclosure. CVE-2025-9562
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-11270). Risk of unauthorized operations or information disclosure. CVE-2025-11270
- Medium 6.4 Cross-Site Scripting (XSS) in WPBakery Page Builder (WordPress plugin) Cross-site scripting in WPBakery Page Builder (WordPress plugin) (CVE-2025-10006). Risk of unauthorized operations or information disclosure. CVE-2025-10006
- Unrated Cross-Site Scripting (XSS) in Mediawiki - SecurePoll Extension Cross-site scripting in Mediawiki - SecurePoll Extension (CVE-2025-11937). Risk of unauthorized operations or information disclosure. CVE-2025-11937
- Medium 6.4 Cross-Site Scripting (XSS) in XX2WP Integration Tools (WordPress plugin) Cross-site scripting in XX2WP Integration Tools (WordPress plugin) (CVE-2025-11857). Risk of unauthorized operations or information disclosure. CVE-2025-11857
- Unrated Cross-Site Scripting (XSS) in Mediawiki - Cargo Extension Cross-site scripting in Mediawiki - Cargo Extension (CVE-2025-62671). Risk of unauthorized operations or information disclosure. CVE-2025-62671
- Unrated Cross-Site Scripting (XSS) in Mediawiki - FlexDiagrams Extension Cross-site scripting in Mediawiki - FlexDiagrams Extension (CVE-2025-62670). Risk of unauthorized operations or information disclosure. CVE-2025-62670
- Unrated Cross-Site Scripting (XSS) in Mediawiki - GrowthExperiments Extension Cross-site scripting in Mediawiki - GrowthExperiments Extension (CVE-2025-62667). Risk of unauthorized operations or information disclosure. CVE-2025-62667
- Unrated Cross-Site Scripting (XSS) in Mediawiki - ImageRating Extension Cross-site scripting in Mediawiki - ImageRating Extension (CVE-2025-62664). Risk of unauthorized operations or information disclosure. CVE-2025-62664
- Unrated Cross-Site Scripting (XSS) in Mediawiki - UploadWizard Extension Cross-site scripting in Mediawiki - UploadWizard Extension (CVE-2025-62663). Risk of unauthorized operations or information disclosure. CVE-2025-62663
- Unrated Cross-Site Scripting (XSS) in Mediawiki - AdvancedSearch Extension Cross-site scripting in Mediawiki - AdvancedSearch Extension (CVE-2025-62662). Risk of unauthorized operations or information disclosure. CVE-2025-62662
- Unrated Cross-Site Scripting (XSS) in Mediawiki - Skin Cross-site scripting in Mediawiki - Skin (CVE-2025-62665). Risk of unauthorized operations or information disclosure. CVE-2025-62665
- Unrated Cross-Site Scripting (XSS) in MediaWiki WebAuthn extension Cross-site scripting in MediaWiki WebAuthn extension (CVE-2025-62652). Risk of unauthorized operations or information disclosure. CVE-2025-62652
- Unrated Cross-Site Scripting (XSS) in MediaWiki PollNY extension Cross-site scripting in MediaWiki PollNY extension (CVE-2025-62653). Risk of unauthorized operations or information disclosure. CVE-2025-62653
- Unrated Cross-Site Scripting (XSS) in MediaWiki QuizGame extension Cross-site scripting in MediaWiki QuizGame extension (CVE-2025-62654). Risk of unauthorized operations or information disclosure. CVE-2025-62654
- Medium 5.4 Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting (XSS)... Cross-site scripting reported (CVE-2025-56320). Risk of unauthorized operations or information disclosure. CVE-2025-56320
- Medium 6.5 Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are… Cross-site scripting reported (CVE-2025-62508). Confidential information can be exposed externally. Mitigation: upgrade to 3.9.0 or later. CVE-2025-62508
- Medium 5.4 Cross-Site Scripting (XSS) in Oxygenz Cross-site scripting in Oxygenz (CVE-2025-62430). Risk of unauthorized operations or information disclosure. CVE-2025-62430
- Medium 6.5 Cross-Site Scripting (XSS) in Memberlite Shortcodes Cross-site scripting in Memberlite Shortcodes (CVE-2025-48087). Risk of unauthorized operations or information disclosure. CVE-2025-48087
- Medium 5.4 Cross-Site Scripting (XSS) in D-Link Nuclias Connect firmware Cross-site scripting in D-Link Nuclias Connect firmware (CVE-2025-34253). Risk of unauthorized operations or information disclosure. CVE-2025-34253
- Medium 6.1 Cross-Site Scripting (XSS) in MQTTX is an MQTT Cross-site scripting in MQTTX is an MQTT (CVE-2025-62413). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 1.12.1 or later. CVE-2025-62413
- Medium 6.1 Cross-Site Scripting (XSS) in Ilevia EVE X1 Server firmware Cross-site scripting in Ilevia EVE X1 Server firmware (CVE-2025-34512). Risk of unauthorized operations or information disclosure. CVE-2025-34512
- Medium 5.5 Cross-Site Scripting (XSS) in LibreNMS Cross-site scripting in LibreNMS (CVE-2025-62411). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 25.10.0 or later. CVE-2025-62411
- Low 3.5 Cross-Site Scripting (XSS) in Apeman ID71 EN75.8.53.20 Cross-site scripting in Apeman ID71 EN75.8.53.20 (CVE-2025-11851). Risk of unauthorized operations or information disclosure. CVE-2025-11851
- Medium 5.4 Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary… Cross-site scripting reported (CVE-2025-55072). Risk of unauthorized operations or information disclosure. CVE-2025-55072
- Medium 5.4 Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary… Cross-site scripting reported (CVE-2025-54760). Risk of unauthorized operations or information disclosure. CVE-2025-54760
- Medium 4.8 Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary… Cross-site scripting reported (CVE-2025-54859). Risk of unauthorized operations or information disclosure. CVE-2025-54859
- Medium 5.4 Stored cross-site scripting (XSS) vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of… Cross-site scripting reported (CVE-2025-24833). Risk of unauthorized operations or information disclosure. CVE-2025-24833
- Medium 6.1 Cross-Site Scripting (XSS) in ChatLuck Cross-site scripting in ChatLuck (CVE-2025-58115). Risk of unauthorized operations or information disclosure. CVE-2025-58115
- Medium 5.4 Cross-Site Scripting (XSS) in ChatLuck Cross-site scripting in ChatLuck (CVE-2025-53858). Risk of unauthorized operations or information disclosure. CVE-2025-53858