slug: xss
Explanation
XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。
例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。
対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
Example
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。
Related tags
Denial of Service8914
SQL Injection4105
Remote Code Execution3036
Path Traversal2142
Privilege Escalation1586
Cross-Site Request Forgery1115
Server-Side Request Forgery887
Authentication Bypass882
Insecure Deserialization784
Buffer Overflow77
Command Injection28
Use After Free20
Credential Leak14
Prototype Pollution7
Integer Overflow7
Vulnerabilities tagged with this 8,597
- Low 3.5 Vulnerability in Bdtask/CodeCanyon SalesERP CVE-2025-13178
- Medium 4.8 Cross-Site Scripting (XSS) in QuickCMS Cross-site scripting in QuickCMS (CVE-2025-10018). Risk of unauthorized operations or information disclosure. CVE-2025-10018
- High 7.2 Cross-Site Scripting (XSS) in SNORDIAN's H5PxAPIkatchu (WordPress plugin) Cross-site scripting in SNORDIAN's H5PxAPIkatchu (WordPress plugin) (CVE-2025-12904). Risk of unauthorized operations or information disclosure. CVE-2025-12904
- Medium 5.5 Vulnerability in Monospace CVE-2025-64747
- Low 2.7 Cross-Site Scripting (XSS) in Astro Cross-site scripting in Astro (CVE-2025-64745). Risk of unauthorized operations or information disclosure. Exploitable via trailingSlash. CVE-2025-64745
- Medium 6.1 Cross-Site Scripting (XSS) in Cisco Catalyst Center Cross-site scripting in Cisco Catalyst Center (CVE-2025-20353). Risk of unauthorized operations or information disclosure. CVE-2025-20353
- Medium 4.3 Cross-Site Scripting (XSS) in Zoom Cross-site scripting in Zoom (CVE-2025-62482). Risk of unauthorized operations or information disclosure. CVE-2025-62482
- Unrated Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan… Cross-site scripting reported (CVE-2025-40681). Risk of unauthorized operations or information disclosure. CVE-2025-40681
- Medium 6.5 Cross-Site Scripting (XSS) in Booking Calendar Cross-site scripting in Booking Calendar (CVE-2025-64381). Risk of unauthorized operations or information disclosure. CVE-2025-64381
- Medium 6.5 Cross-Site Scripting (XSS) in Booster for WooCommerce Cross-site scripting in Booster for WooCommerce (CVE-2025-64380). Risk of unauthorized operations or information disclosure. CVE-2025-64380
- Medium 6.5 Cross-Site Scripting (XSS) in Qi Blocks Cross-site scripting in Qi Blocks (CVE-2025-64383). Risk of unauthorized operations or information disclosure. CVE-2025-64383
- Medium 6.5 Cross-Site Scripting (XSS) in Analytics Germanized for Google Analytics Cross-site scripting in Analytics Germanized for Google Analytics (CVE-2025-64292). Risk of unauthorized operations or information disclosure. CVE-2025-64292
- Medium 6.5 Cross-Site Scripting (XSS) in Booking Manager Cross-site scripting in Booking Manager (CVE-2025-64275). Risk of unauthorized operations or information disclosure. CVE-2025-64275
- Medium 5.9 Cross-Site Scripting (XSS) in Popup addon for Ninja Forms Cross-site scripting in Popup addon for Ninja Forms (CVE-2025-64264). Risk of unauthorized operations or information disclosure. CVE-2025-64264
- Medium 6.4 Cross-Site Scripting (XSS) in Save as PDF Button (WordPress plugin) Cross-site scripting in Save as PDF Button (WordPress plugin) (CVE-2025-8397). Risk of unauthorized operations or information disclosure. CVE-2025-8397
- Medium 6.4 Cross-Site Scripting (XSS) in WordPress Content Flipper (WordPress plugin) Cross-site scripting in WordPress Content Flipper (WordPress plugin) (CVE-2025-11769). Risk of unauthorized operations or information disclosure. CVE-2025-11769
- Medium 6.4 Cross-Site Scripting (XSS) in Angel – Fashion Model Agency WordPress CMS Theme (WordPress theme) Cross-site scripting in Angel – Fashion Model Agency WordPress CMS Theme (WordPress theme) (CVE-2025-10295). Risk of unauthorized operations or information disclosure. CVE-2025-10295
- Unrated Cross-Site Scripting (XSS) in WebInteropApp/WebAppInterop Cross-site scripting in WebInteropApp/WebAppInterop (CVE-2025-64710). Risk of unauthorized operations or information disclosure. CVE-2025-64710
- Low 3.9 Cross-Site Scripting (XSS) in PrivateBin Cross-site scripting in PrivateBin (CVE-2025-64711). Risk of unauthorized operations or information disclosure. CVE-2025-64711
- Medium 5.4 Vulnerability in IBM OpenPages CVE-2025-36223
- Low 3.5 Cross-Site Scripting (XSS) in soerennb eXtplorer Cross-site scripting in soerennb eXtplorer (CVE-2025-13058). Risk of unauthorized operations or information disclosure. CVE-2025-13058
- High 7.3 Cross-Site Scripting (XSS) in Digital Corporate Warehouse Cross-site scripting in Digital Corporate Warehouse (CVE-2025-11962). Confidential information can be exposed externally. CVE-2025-11962
- High 7.2 Cross-Site Scripting (XSS) in Easy Email Subscription (WordPress plugin) Cross-site scripting in Easy Email Subscription (WordPress plugin) (CVE-2025-11994). Risk of unauthorized operations or information disclosure. CVE-2025-11994
- Medium 6.5 Cross-Site Scripting (XSS) in Apache Ofbiz Cross-site scripting in Apache Ofbiz (CVE-2025-61623). Risk of unauthorized operations or information disclosure. CVE-2025-61623
- Medium 4.8 Cross-Site Scripting (XSS) in Aenrich Cross-site scripting in Aenrich (CVE-2025-12869). Risk of unauthorized operations or information disclosure. CVE-2025-12869
- Medium 5.4 The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote… Cross-site scripting reported (CVE-2025-12872). Risk of unauthorized operations or information disclosure. CVE-2025-12872
- Medium 4.4 Cross-Site Scripting (XSS) in MembershipWorks – Membership, Events & Directory (WordPress plugin) Cross-site scripting in MembershipWorks – Membership, Events & Directory (WordPress plugin) (CVE-2025-12018). Risk of unauthorized operations or information disclosure. CVE-2025-12018
- High 7.1 Vulnerability in Team Members Showcase (WordPress plugin) CVE-2025-11560
- High 8.7 Cross-Site Scripting (XSS) in Dynamics 365 Field Service Cross-site scripting in Dynamics 365 Field Service (CVE-2025-62211). Confidential information can be exposed externally. CVE-2025-62211
- High 8.7 Cross-Site Scripting (XSS) in Dynamics 365 Field Service Cross-site scripting in Dynamics 365 Field Service (CVE-2025-62210). Confidential information can be exposed externally. CVE-2025-62210