slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Low 2.4 Cross-Site Scripting (XSS) in alokjaiswal Hotel-Management-services-using-MYSQL-and-php Cross-site scripting in alokjaiswal Hotel-Management-services-using-MYSQL-and-php (CVE-2025-14201). Risk of unauthorized operations or information disclosure. CVE-2025-14201
- Low 3.5 Cross-Site Scripting (XSS) in alokjaiswal Hotel-Management-services-using-MYSQL-and-php Cross-site scripting in alokjaiswal Hotel-Management-services-using-MYSQL-and-php (CVE-2025-14200). Risk of unauthorized operations or information disclosure. CVE-2025-14200
- Low 3.5 Cross-Site Scripting (XSS) in code-projects Employee Profile Management System Cross-site scripting in code-projects Employee Profile Management System (CVE-2025-14194). Risk of unauthorized operations or information disclosure. CVE-2025-14194
- Low 3.5 Vulnerability in Grandstream GXP1625 CVE-2025-14186
- High 7.2 Cross-Site Scripting (XSS) in Rich Shortcodes for Google Reviews (WordPress plugin) Cross-site scripting in Rich Shortcodes for Google Reviews (WordPress plugin) (CVE-2025-12499). Risk of unauthorized operations or information disclosure. CVE-2025-12499
- Medium 6.4 Cross-Site Scripting (XSS) in CSS3 Buttons (WordPress plugin) Cross-site scripting in CSS3 Buttons (WordPress plugin) (CVE-2025-13907). Risk of unauthorized operations or information disclosure. CVE-2025-13907
- Medium 6.4 Cross-Site Scripting (XSS) in Social Feed Gallery Portfolio (WordPress plugin) Cross-site scripting in Social Feed Gallery Portfolio (WordPress plugin) (CVE-2025-13896). Risk of unauthorized operations or information disclosure. CVE-2025-13896
- Medium 6.4 Cross-Site Scripting (XSS) in TR Timthumb (WordPress plugin) Cross-site scripting in TR Timthumb (WordPress plugin) (CVE-2025-13899). Risk of unauthorized operations or information disclosure. CVE-2025-13899
- Medium 6.4 Cross-Site Scripting (XSS) in Ultra Skype Button (WordPress plugin) Cross-site scripting in Ultra Skype Button (WordPress plugin) (CVE-2025-13898). Risk of unauthorized operations or information disclosure. CVE-2025-13898
- Medium 6.4 Cross-Site Scripting (XSS) in Cute News Ticker (WordPress plugin) Cross-site scripting in Cute News Ticker (WordPress plugin) (CVE-2025-13656). Risk of unauthorized operations or information disclosure. CVE-2025-13656
- Medium 6.4 Cross-Site Scripting (XSS) in Extra Post Images (WordPress plugin) Cross-site scripting in Extra Post Images (WordPress plugin) (CVE-2025-13856). Risk of unauthorized operations or information disclosure. CVE-2025-13856
- Medium 6.1 Cross-Site Scripting (XSS) in CSV Sumotto (WordPress plugin) Cross-site scripting in CSV Sumotto (WordPress plugin) (CVE-2025-13894). Risk of unauthorized operations or information disclosure. CVE-2025-13894
- Medium 6.4 Cross-Site Scripting (XSS) in RevInsite (WordPress plugin) Cross-site scripting in RevInsite (WordPress plugin) (CVE-2025-13863). Risk of unauthorized operations or information disclosure. Exploitable via token. CVE-2025-13863
- Medium 6.4 Cross-Site Scripting (XSS) in Yet Another WebClap for (WordPress plugin) Cross-site scripting in Yet Another WebClap for (WordPress plugin) (CVE-2025-13857). Risk of unauthorized operations or information disclosure. CVE-2025-13857
- Medium 6.1 Cross-Site Scripting (XSS) in Live Sales Notification for Woocommerce – Woomotiv (WordPress plugin) Cross-site scripting in Live Sales Notification for Woocommerce – Woomotiv (WordPress plugin) (CVE-2025-13137). Risk of unauthorized operations or information disclosure. CVE-2025-13137
- Medium 6.1 Cross-Site Scripting (XSS) in myLCO (WordPress plugin) Cross-site scripting in myLCO (WordPress plugin) (CVE-2025-13626). Risk of unauthorized operations or information disclosure. CVE-2025-13626
- Medium 5.4 Cross-Site Scripting (XSS) in Application Passwords (WordPress plugin) Cross-site scripting in Application Passwords (WordPress plugin) (CVE-2025-13308). Risk of unauthorized operations or information disclosure. CVE-2025-13308
- Medium 6.4 Cross-Site Scripting (XSS) in List Attachments Shortcode (WordPress plugin) Cross-site scripting in List Attachments Shortcode (WordPress plugin) (CVE-2025-12717). Risk of unauthorized operations or information disclosure. CVE-2025-12717
- Medium 6.4 Cross-Site Scripting (XSS) in Canadian Nutrition Facts Label (WordPress plugin) Cross-site scripting in Canadian Nutrition Facts Label (WordPress plugin) (CVE-2025-12715). Risk of unauthorized operations or information disclosure. CVE-2025-12715
- High 7.2 Cross-Site Scripting (XSS) in Widgets for Google Reviews (WordPress plugin) Cross-site scripting in Widgets for Google Reviews (WordPress plugin) (CVE-2025-12510). Risk of unauthorized operations or information disclosure. CVE-2025-12510
- Medium 6.1 Cross-Site Scripting (XSS) in Link Whisper Free (WordPress plugin) Cross-site scripting in Link Whisper Free (WordPress plugin) (CVE-2025-11263). Risk of unauthorized operations or information disclosure. CVE-2025-11263
- Critical 9.6 Cross-Site Scripting (XSS) in TUUI Cross-site scripting in TUUI (CVE-2025-66562). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 1.3.4 or later. CVE-2025-66562
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34266). Risk of unauthorized operations or information disclosure. CVE-2025-34266
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34263). Risk of unauthorized operations or information disclosure. CVE-2025-34263
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34264). Risk of unauthorized operations or information disclosure. CVE-2025-34264
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34265). Risk of unauthorized operations or information disclosure. CVE-2025-34265
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34261). Risk of unauthorized operations or information disclosure. CVE-2025-34261
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34257). Risk of unauthorized operations or information disclosure. CVE-2025-34257
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34258). Risk of unauthorized operations or information disclosure. CVE-2025-34258
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34260). Risk of unauthorized operations or information disclosure. CVE-2025-34260