Connexion Inscription
JA · EN · FR
SecPulse

Cross-Site Scripting

⚔️ Attack Types Liées 27
slug: xss

Explication

XSSは「Webページの中に、攻撃者の悪意あるJavaScriptを忍び込ませる」攻撃です。 例えば掲示板に `<script>盗む()</script>` のような投稿をして、それを見た他のユーザーのCookie (ログイン情報) を盗む、といった攻撃が典型的です。 対策は「ユーザー入力を画面に出すときに、HTMLとして無害化 (エスケープ) する」こと。多くのフレームワークでは標準で対策されています。
📌 Exemple
2005年MySpaceワーム「Samy」: 1人の投稿が見るだけで他人のプロフィールにコピーされ、24時間で100万人に感染した有名事件。

🔖 Étiquettes liées

Denial of Service85 SQL Injection23 Remote Code Execution19 Server-Side Request Forgery17 Path Traversal14 Privilege Escalation7 Authentication Bypass4 Insecure Deserialization4 Cross-Site Request Forgery1

🛡 Vulnérabilités associées 4,822

ID Titre
CVE-2026-65528 Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
CVE-2026-65538 Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
CVE-2026-65606 XSS (Cross-Site Scripting) dans CVE-2026-65606 (CVE-2026-65606)
CVE-2026-65605 XSS (Cross-Site Scripting) dans CVE-2026-65605 (CVE-2026-65605)
CVE-2026-65550 Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
CVE-2026-65533 Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
CVE-2026-65527 Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
CVE-2026-65522 XSS (Cross-Site Scripting) dans wordpress (CVE-2026-65522)
CVE-2026-65514 Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
CVE-2026-65518 Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
CVE-2026-65503 Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-65492 Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions.
CVE-2026-65510 Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65519 Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
CVE-2026-65511 XSS (Cross-Site Scripting) dans wordpress (CVE-2026-65511)
CVE-2026-65482 Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65470 Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
CVE-2026-65480 Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.
CVE-2026-65465 Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
CVE-2026-65473 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
CVE-2026-65483 Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
CVE-2026-65475 XSS (Cross-Site Scripting) dans CVE-2026-65475 (CVE-2026-65475)
CVE-2026-61947 XSS (Cross-Site Scripting) dans CVE-2026-61947 (CVE-2026-61947)
CVE-2026-61944 Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
CVE-2026-65449 Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
CVE-2026-57704 Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.
CVE-2026-57735 Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
CVE-2026-57427 Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.
CVE-2026-59513 Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.
CVE-2026-59517 Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

🍪 À propos des cookies

Nous utilisons des cookies pour conserver votre session, mémoriser la langue et améliorer le service.

En savoir plus →