slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34258). Risk of unauthorized operations or information disclosure. CVE-2025-34258
- Medium 5.4 Cross-Site Scripting (XSS) in Advantech WISE-DeviceOn Server Cross-site scripting in Advantech WISE-DeviceOn Server (CVE-2025-34262). Risk of unauthorized operations or information disclosure. CVE-2025-34262
- Critical 9.6 Cross-Site Scripting (XSS) in Fanvil Cross-site scripting in Fanvil (CVE-2025-64054). Successful exploitation can lead to full system takeover. CVE-2025-64054
- Medium 6.4 Cross-Site Scripting (XSS) in Thai Lottery Widget (WordPress plugin) Cross-site scripting in Thai Lottery Widget (WordPress plugin) (CVE-2025-13678). Risk of unauthorized operations or information disclosure. Exploitable via thailottery. CVE-2025-13678
- Medium 6.4 Cross-Site Scripting (XSS) in CryptX (WordPress plugin) Cross-site scripting in CryptX (WordPress plugin) (CVE-2025-13739). Risk of unauthorized operations or information disclosure. Exploitable via cryptx. CVE-2025-13739
- Medium 4.4 Cross-Site Scripting (XSS) in Trail Manager (WordPress plugin) Cross-site scripting in Trail Manager (WordPress plugin) (CVE-2025-13682). Risk of unauthorized operations or information disclosure. CVE-2025-13682
- High 8.1 Cross-Site Scripting (XSS) in Cool Tag Cloud (WordPress plugin) Cross-site scripting in Cool Tag Cloud (WordPress plugin) (CVE-2025-13614). Confidential information can be exposed externally. CVE-2025-13614
- Medium 6.1 Cross-Site Scripting (XSS) in Nouri.sh Newsletter (WordPress plugin) Cross-site scripting in Nouri.sh Newsletter (WordPress plugin) (CVE-2025-13515). Risk of unauthorized operations or information disclosure. CVE-2025-13515
- Medium 4.4 Cross-Site Scripting (XSS) in Weekly Planner (WordPress plugin) Cross-site scripting in Weekly Planner (WordPress plugin) (CVE-2025-12186). Risk of unauthorized operations or information disclosure. CVE-2025-12186
- Medium 6.4 Cross-Site Scripting (XSS) in Easy Jump Links Menus (WordPress plugin) Cross-site scripting in Easy Jump Links Menus (WordPress plugin) (CVE-2025-13860). Risk of unauthorized operations or information disclosure. Exploitable via h_tags. CVE-2025-13860
- Medium 6.1 Cross-Site Scripting (XSS) in Jabbernotification (WordPress plugin) Cross-site scripting in Jabbernotification (WordPress plugin) (CVE-2025-13622). Risk of unauthorized operations or information disclosure. CVE-2025-13622
- Medium 6.1 Cross-Site Scripting (XSS) in WordPress Cross-site scripting in WordPress (CVE-2025-13625). Risk of unauthorized operations or information disclosure. CVE-2025-13625
- Medium 6.1 Cross-Site Scripting (XSS) in Twitscription (WordPress plugin) Cross-site scripting in Twitscription (WordPress plugin) (CVE-2025-13623). Risk of unauthorized operations or information disclosure. CVE-2025-13623
- Medium 6.1 Cross-Site Scripting (XSS) in CoSign Single Signon (WordPress plugin) Cross-site scripting in CoSign Single Signon (WordPress plugin) (CVE-2025-13512). Risk of unauthorized operations or information disclosure. CVE-2025-13512
- Medium 6.4 Cross-Site Scripting (XSS) in Sermon Manager (WordPress plugin) Cross-site scripting in Sermon Manager (WordPress plugin) (CVE-2025-12368). Risk of unauthorized operations or information disclosure. CVE-2025-12368
- Medium 6.4 Cross-Site Scripting (XSS) in Omnipress (WordPress plugin) Cross-site scripting in Omnipress (WordPress plugin) (CVE-2025-12163). Risk of unauthorized operations or information disclosure. CVE-2025-12163
- Medium 5.4 Cross-Site Scripting (XSS) in PDF Catalog for WooCommerce (WordPress plugin) Cross-site scripting in PDF Catalog for WooCommerce (WordPress plugin) (CVE-2025-12191). Risk of unauthorized operations or information disclosure. CVE-2025-12191
- Medium 4.4 Cross-Site Scripting (XSS) in FitVids for (WordPress plugin) Cross-site scripting in FitVids for (WordPress plugin) (CVE-2025-12124). Risk of unauthorized operations or information disclosure. CVE-2025-12124
- Medium 6.4 Cross-Site Scripting (XSS) in SurveyFunnel – Survey Plugin for (WordPress plugin) Cross-site scripting in SurveyFunnel – Survey Plugin for (WordPress plugin) (CVE-2025-12417). Risk of unauthorized operations or information disclosure. CVE-2025-12417
- Medium 4.8 Cross-Site Scripting (XSS) in Watchguard Firebox Cross-site scripting in Watchguard Firebox (CVE-2025-6946). Risk of unauthorized operations or information disclosure. CVE-2025-6946
- High 7.3 Cross-Site Scripting (XSS) in SysReptor Cross-site scripting in SysReptor (CVE-2025-66561). Confidential information can be exposed externally. Mitigation: upgrade to 2025.102 or later. CVE-2025-66561
- Medium 6.1 Cross-Site Scripting (XSS) in WatchGuard Fireware OS Cross-site scripting in WatchGuard Fireware OS (CVE-2025-13939). Risk of unauthorized operations or information disclosure. CVE-2025-13939
- Medium 5.4 Cross-Site Scripting (XSS) in TranzAxis Cross-site scripting in TranzAxis (CVE-2025-66574). Risk of unauthorized operations or information disclosure. CVE-2025-66574
- High 8.7 Cross-Site Scripting (XSS) in Open WebUI Cross-site scripting in Open WebUI (CVE-2025-65959). Confidential information can be exposed externally. Mitigation: upgrade to 0.6.37 or later. CVE-2025-65959
- Unrated Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded… Cross-site scripting reported (CVE-2025-13488). Risk of unauthorized operations or information disclosure. CVE-2025-13488
- Low 2.4 Cross-Site Scripting (XSS) in JIZHICMS Cross-site scripting in JIZHICMS (CVE-2025-14013). Risk of unauthorized operations or information disclosure. CVE-2025-14013
- Low 2.0 Cross-Site Scripting (XSS) in dayrui XunRuiCMS Cross-site scripting in dayrui XunRuiCMS (CVE-2025-14007). Risk of unauthorized operations or information disclosure. CVE-2025-14007
- Low 3.5 Cross-Site Scripting (XSS) in dayrui XunRuiCMS Cross-site scripting in dayrui XunRuiCMS (CVE-2025-14006). Risk of unauthorized operations or information disclosure. CVE-2025-14006
- Medium 6.1 Cross-Site Scripting (XSS) in Seafile Cross-site scripting in Seafile (CVE-2025-41080). Risk of unauthorized operations or information disclosure. CVE-2025-41080
- Medium 6.1 Cross-Site Scripting (XSS) in Seafile Cross-site scripting in Seafile (CVE-2025-41079). Risk of unauthorized operations or information disclosure. CVE-2025-41079