slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,584
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34805). Risk of unauthorized operations or information disclosure. CVE-2026-34805
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34806). Risk of unauthorized operations or information disclosure. CVE-2026-34806
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34799). Risk of unauthorized operations or information disclosure. CVE-2026-34799
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34800). Risk of unauthorized operations or information disclosure. CVE-2026-34800
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34801). Risk of unauthorized operations or information disclosure. CVE-2026-34801
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34802). Risk of unauthorized operations or information disclosure. CVE-2026-34802
- Medium 6.4 Cross-Site Scripting (XSS) in Endian Firewall Cross-site scripting in Endian Firewall (CVE-2026-34798). Risk of unauthorized operations or information disclosure. CVE-2026-34798
- Medium 5.5 Cross-Site Scripting (XSS) in IBM Aspera Shares Cross-site scripting in IBM Aspera Shares (CVE-2025-66484). Risk of unauthorized operations or information disclosure. CVE-2025-66484
- Medium 5.4 Vulnerability in IBM Aspera Shares CVE-2025-66485
- Medium 4.8 Cross-Site Scripting (XSS) in Cisco IMC Cross-site scripting in Cisco IMC (CVE-2026-20090). Risk of unauthorized operations or information disclosure. CVE-2026-20090
- Medium 4.8 Cross-Site Scripting (XSS) in Cisco IMC Cross-site scripting in Cisco IMC (CVE-2026-20089). Risk of unauthorized operations or information disclosure. CVE-2026-20089
- Medium 4.8 Cross-Site Scripting (XSS) in Cisco IMC Cross-site scripting in Cisco IMC (CVE-2026-20088). Risk of unauthorized operations or information disclosure. CVE-2026-20088
- Medium 4.8 Cross-Site Scripting (XSS) in Cisco IMC Cross-site scripting in Cisco IMC (CVE-2026-20087). Risk of unauthorized operations or information disclosure. CVE-2026-20087
- Medium 6.1 Cross-Site Scripting (XSS) in SourceCodester Zoo Management System Cross-site scripting in SourceCodester Zoo Management System (CVE-2026-30526). Risk of unauthorized operations or information disclosure. CVE-2026-30526
- Medium 5.4 Cross-Site Scripting (XSS) in DDSN Interactive Acora CMS Cross-site scripting in DDSN Interactive Acora CMS (CVE-2026-29598). Risk of unauthorized operations or information disclosure. CVE-2026-29598
- Medium 6.4 Cross-Site Scripting (XSS) in King Addons for Elementor (WordPress plugin) Cross-site scripting in King Addons for Elementor (WordPress plugin) (CVE-2025-13535). Risk of unauthorized operations or information disclosure. CVE-2025-13535
- Critical 9.0 Cross-Site Scripting (XSS) in github.com/siyuan-note/siyuan/kernel Cross-site scripting in github.com/siyuan-note/siyuan/kernel (CVE-2026-34448). Successful exploitation can lead to full system takeover. Exploitable via mAsse. Mitigation: upgrade to 3.6.2 or later. CVE-2026-34448
- Medium 4.8 Cross-Site Scripting (XSS) in Sonicwall Email Security Cross-site scripting in Sonicwall Email Security (CVE-2026-3468). Risk of unauthorized operations or information disclosure. CVE-2026-3468
- Medium 6.4 Cross-Site Scripting (XSS) in WWBN AVideo Cross-site scripting in WWBN AVideo (CVE-2026-34716). Risk of unauthorized operations or information disclosure. CVE-2026-34716
- Medium 6.1 Cross-Site Scripting (XSS) in Captcha Protect Cross-site scripting in Captcha Protect (CVE-2026-34206). Risk of unauthorized operations or information disclosure. CVE-2026-34206
- Low 2.4 Cross-Site Scripting (XSS) in SourceCodester Leave Application System Cross-site scripting in SourceCodester Leave Application System (CVE-2026-5209). Risk of unauthorized operations or information disclosure. CVE-2026-5209
- Medium 5.4 Cross-Site Scripting (XSS) in Discourse Cross-site scripting in Discourse (CVE-2026-32273). Risk of unauthorized operations or information disclosure. CVE-2026-32273
- Low 3.4 Cross-Site Scripting (XSS) in Pega Platform Cross-site scripting in Pega Platform (CVE-2025-62184). Risk of unauthorized operations or information disclosure. CVE-2025-62184
- Medium 6.1 Cross-Site Scripting (XSS) in slippers Cross-site scripting in slippers (CVE-2026-34231). Risk of unauthorized operations or information disclosure. Exploitable via slippers. Mitigation: upgrade to 0.6.3 or later. CVE-2026-34231
- Medium 5.4 Cross-Site Scripting (XSS) in Checkmk Cross-site scripting in Checkmk (CVE-2026-33276). Risk of unauthorized operations or information disclosure. CVE-2026-33276
- Medium 5.4 Cross-Site Scripting (XSS) in Checkmk Cross-site scripting in Checkmk (CVE-2026-20915). Risk of unauthorized operations or information disclosure. CVE-2026-20915
- High 7.2 Cross-Site Scripting (XSS) in Query Monitor – The developer tools panel for (WordPress plugin) Cross-site scripting in Query Monitor – The developer tools panel for (WordPress plugin) (CVE-2026-4267). Risk of unauthorized operations or information disclosure. CVE-2026-4267
- Medium 6.1 Cross-Site Scripting (XSS) in IngEstate Server Cross-site scripting in IngEstate Server (CVE-2026-30082). Risk of unauthorized operations or information disclosure. CVE-2026-30082
- Unrated Cross-Site Scripting (XSS) in trix Cross-site scripting in trix (CVE-2026-73427). Risk of unauthorized operations or information disclosure. Exploitable via StringPiece.fromJSON. Mitigation: upgrade to 2.1.18 or later. CVE-2026-73427
- Medium 6.1 Cross-Site Scripting (XSS) in dompurify Cross-site scripting in dompurify (CVE-2026-65914). Risk of unauthorized operations or information disclosure. Exploitable via POST /sanitize. Mitigation: upgrade to 3.3.2 or later. CVE-2026-65914