Browse / Cross-site Scripting

Cross-site Scripting

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cross-site Scripting (XSS) - Generic1,048
• Cross-site Scripting (XSS) - Reflected674
• Cross-site Scripting (XSS) - Stored663
• Cross-site Scripting (XSS) - DOM182
• Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)17
• Cross-Site Scripting (XSS)2
• Reflected XSS1

Often found together with

• Cross-Site Request Forgery148
• Authentication125
• Misconfiguration122
• Information Disclosure120
• Code Execution86
• Access Control72
• Injection and Smuggling52
• Open Redirect48

Most upvoted Cross-site Scripting reports

AllValidInformativeN/ADuplicate

1. Reflected XSS on https://www.glassdoor.com/employers/sem-dual-lp/Cross-site Scripting (XSS) - Reflected · Glassdoor
   684 votes
2. Stored XSS in Wiki pagesCross-site Scripting (XSS) - Stored · high · GitLab
   633 votes
3. Stored XSS on imgur profileCross-site Scripting (XSS) - Stored · medium · Imgur
   614 votes
4. The return of the ＜Cross-site Scripting (XSS) - Stored · high · Rockstar Games
   $1,000576 votes
5. [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureCross-site Scripting (XSS) - Generic · high · Grab
   552 votes
6. XSS in steam react chat clientCross-site Scripting (XSS) - Stored · critical · Valve
   $7,500499 votes
7. Reflected XSS in OAUTH2 login flow Cross-site Scripting (XSS) - Reflected · medium · LY Corporation
   $1,990489 votes
8. Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationCross-site Scripting (XSS) - Reflected · high · TikTok
   473 votes
9. XSS vulnerable parameter in a location hashCross-site Scripting (XSS) - Generic · Slack
   455 votes
10. Blind XSS on image uploadCross-site Scripting (XSS) - Stored · critical · CS Money
    $1,000450 votes
11. Stored XSS VulnerabilityCross-site Scripting (XSS) - Stored · high · WordPress
    403 votes
12. [accounts.reddit.com] Redirect parameter allows for XSSCross-site Scripting (XSS) - Generic · high · Reddit
    $5,000394 votes
13. Reflected XSS on www.hackerone.com and resources.hackerone.comCross-site Scripting (XSS) - Reflected · low · HackerOne
    $500387 votes
14. HEY.com email stored XSSCross-site Scripting (XSS) - Stored · critical · Basecamp
    $5,000360 votes
15. Blind XSS on Twitter's internal Big Data panel at █████████████Cross-site Scripting (XSS) - Stored · critical · X / xAI
    357 votes
16. Reflected XSS in TikTok endpointsCross-site Scripting (XSS) - Reflected · medium · TikTok
    356 votes
17. Stored XSS in wordpress.comCross-site Scripting (XSS) - Stored · high · Automattic
    356 votes
18. XSS while logging using GoogleCross-site Scripting (XSS) - Reflected · Shopify
    $1,750341 votes
19. Stored XSS in Private Message component (BuddyPress)Cross-site Scripting (XSS) - Stored · critical · WordPress
    337 votes
20. Stored XSS in my staff name fired in another your internal panelCross-site Scripting (XSS) - Stored · high · Shopify
    326 votes
21. DOM XSS on duckduckgo.com searchCross-site Scripting (XSS) - DOM · high · DuckDuckGo
    326 votes
22. yelp.com XSS ATO (via login keylogger, link Google account)Cross-site Scripting (XSS) - Generic · high · Yelp
    324 votes
23. Stored XSS in markdown via the DesignReferenceFilter Cross-site Scripting (XSS) - Stored · critical · GitLab
    $16,000317 votes
24. Reflected XSSCross-site Scripting (XSS) - Reflected · critical · Bumble
    $1,000317 votes
25. Stored-XSS-ads.tiktok.comCross-site Scripting (XSS) - Stored · low · TikTok
    310 votes
26. Stored XSS via Kroki diagramCross-site Scripting (XSS) - Stored · high · GitLab
    $13,950295 votes
27. Account takeover through the combination of cookie manipulation and XSSCross-site Scripting (XSS) - Stored · high · Superhuman (formerly Grammarly)
    292 votes
28. Reflected XSS at https://pay.gold.razer.com escalated to account takeoverCross-site Scripting (XSS) - Reflected · Razer
    $750287 votes
29. RichText parser vulnerability in scheduled posts allows XSSCross-site Scripting (XSS) - Stored · high · Reddit
    $5,000280 votes
30. XSS At "pages.et.uber.com"N/ACross-site Scripting (XSS) - Generic · Uber
    267 votes
31. Persistent XSS on keybase.io via "payload" field in `/user/sigchain_signature.toffee` templateCross-site Scripting (XSS) - Stored · Keybase
    266 votes
32. Arbitrary File Upload to Stored XSSCross-site Scripting (XSS) - Stored · Visma Public
    $250245 votes
33. Stored xss in address field in billing activity at https://shop.aaf.com/Order/step1/index.cfmCross-site Scripting (XSS) - Stored · high · Alliance of American Football
    244 votes
34. XSS at jamfpro.shopifycloud.comCross-site Scripting (XSS) - Generic · medium · Shopify
    $9,400240 votes
35. Cross-site Scripting (XSS) on HackerOne careers pageCross-site Scripting (XSS) - DOM · low · HackerOne
    $500239 votes
36. Reflected XSS on www.hackerone.com via Wistia embed codeCross-site Scripting (XSS) - Reflected · low · HackerOne
    $500236 votes
37. XSS via Direct Message deeplinksCross-site Scripting (XSS) - DOM · X / xAI
    236 votes
38. Stored XSS on reports.Cross-site Scripting (XSS) - Stored · high · X / xAI
    $700232 votes
39. Unsafe charts embedding implementation leads to cross-account stored XSS and SSRFCross-site Scripting (XSS) - Stored · New Relic
    225 votes
40. Stored XSS in developer.uber.comCross-site Scripting (XSS) - Generic · Uber
    $7,500223 votes
41. [www.zomato.com] Blind XSS on one of the Admin DashboardCross-site Scripting (XSS) - Generic · high · Eternal
    $750221 votes
42. Cache Poisoning allows redirection on JS filesCross-site Scripting (XSS) - Stored · Glassdoor
    219 votes
43. [panel.city-mobil.ru/admin/] Blind XSS into usernameCross-site Scripting (XSS) - Stored · Mail.ru
    219 votes
44. XSS via Mod Log Removed PostsCross-site Scripting (XSS) - Stored · high · Reddit
    218 votes
45. Account Takeover in Periscope TVCross-site Scripting (XSS) - Generic · high · X / xAI
    213 votes
46. DOM Based XSS in www.hackerone.com via PostMessageCross-site Scripting (XSS) - DOM · low · HackerOne
    $500208 votes
47. Ability to create own account UUID leads to stored XSSCross-site Scripting (XSS) - Stored · high · Upserve
    $1,500207 votes
48. Cross application scripting via account.mail.ruCross-site Scripting (XSS) - Stored · Mail.ru
    $5,000205 votes
49. Stored XSS on TikTok AdsCross-site Scripting (XSS) - DOM · medium · TikTok
    201 votes
50. XSS and cache poisoning via upload.twitter.com on ton.twitter.comCross-site Scripting (XSS) - Generic · X / xAI
    198 votes
51. Reflected XSS on Pangle Endpoint Cross-site Scripting (XSS) - Reflected · high · TikTok
    $5,000196 votes
52. H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingCross-site Scripting (XSS) - DOM · high · Shopify
    195 votes
53. XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)Cross-site Scripting (XSS) - Stored · medium · Rockstar Games
    194 votes
54. Stored Xss Vulnerability on ████████Cross-site Scripting (XSS) - Stored · high · U.S. Dept Of Defense
    192 votes
55. Markdown parsing issue enables insertion of malicious tags and event handlersCross-site Scripting (XSS) - Stored · high · HackerOne
    $5,000184 votes
56. Reflected Cross site Scripting (XSS) on www.starbucks.comCross-site Scripting (XSS) - Reflected · medium · Starbucks
    181 votes
57. XSS on Desktop ClientCross-site Scripting (XSS) - DOM · Keybase
    175 votes
58. XSS at https://exchangemarketplace.com/blogsearchCross-site Scripting (XSS) - Generic · medium · Shopify
    174 votes
59. RXSS at image.hackerone.live via the `url` parameterCross-site Scripting (XSS) - Reflected · low · HackerOne
    $500171 votes
60. DOM Based XSS via postMessage at https://inventory.upserve.com/login/Cross-site Scripting (XSS) - DOM · high · Upserve
    $2,500171 votes
61. Stored-XSS with CSP-bypass via labels' colorCross-site Scripting (XSS) - Stored · high · GitLab
    169 votes
62. Reflected xss in https://sh.reddit.comCross-site Scripting (XSS) - Reflected · high · Reddit
    $5,000166 votes
63. Stored XSS in Notes (with CSP bypass for gitlab.com)Cross-site Scripting (XSS) - Stored · high · GitLab
    161 votes
64. HTML Injection on TikTok AdsImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low · TikTok
    159 votes
65. XSS in www.shopify.com/markets?utm_source=Cross-site Scripting (XSS) - Reflected · low · Shopify
    159 votes
66. xss on https://www.rockstargames.com/GTAOnline/jp/screens/ Cross-site Scripting (XSS) - Generic · medium · Rockstar Games
    159 votes
67. Cross-account stored XSS at embedded chartsCross-site Scripting (XSS) - Stored · New Relic
    158 votes
68. XSS Reflected on reddit.com via url pathCross-site Scripting (XSS) - Reflected · high · Reddit
    157 votes
69. Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Cross-site Scripting (XSS) - DOM · high · Elastic
    157 votes
70. XSS in gist integrationCross-site Scripting (XSS) - Generic · Slack
    $500157 votes
71. IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifierCross-site Scripting (XSS) - Stored · medium · HackerOne
    $2,500156 votes
72. Stored XSS in SVG file as data: urlCross-site Scripting (XSS) - Stored · medium · Shopify
    $5,300153 votes
73. #1 XSS on watchdocs.indriverapp.comCross-site Scripting (XSS) - Reflected · low · inDrive
    147 votes
74. Stored XSS in notes (charts) because of insecure chart data JSON generationCross-site Scripting (XSS) - Stored · New Relic
    147 votes
75. Stored XSS in IE11 on hackerone.com via custom fields Cross-site Scripting (XSS) - Stored · medium · HackerOne
    146 votes
76. CSRF leads to a stored self xssCross-site Scripting (XSS) - Reflected · low · Imgur
    145 votes
77. XSS reflected on [https://www.pixiv.net]Cross-site Scripting (XSS) - Reflected · medium · pixiv
    $500144 votes
78. DOM XSS in tiktok.com/login via the redirect_url parameterCross-site Scripting (XSS) - DOM · high · TikTok
    140 votes
79. Reflected XSS in twitterflightschool.comCross-site Scripting (XSS) - Reflected · X / xAI
    140 votes
80. Stored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/Cross-site Scripting (XSS) - Stored · high · Autodesk
    139 votes
81. Persistent XSS in Note objectsCross-site Scripting (XSS) - Stored · high · GitLab
    $4,500139 votes
82. XSS via message subject - mobile applicationCross-site Scripting (XSS) - DOM · Mail.ru
    $1,000139 votes
83. Reflected XSS at https://www.paypal.com/ppcreditapply/da/usCross-site Scripting (XSS) - Reflected · medium · PayPal
    137 votes
84. XSS - main page - search[user_id] parameterCross-site Scripting (XSS) - Reflected · OLX
    137 votes
85. Reflected/Stored XSS on duckduckgo.comCross-site Scripting (XSS) - Reflected · high · DuckDuckGo
    135 votes
86. [oem.acronis.com] Reflected Cross Site Scripting Cross-site Scripting (XSS) - Reflected · medium · Acronis
    $100134 votes
87. Web Cache Poisoning leads to Stored XSS Cross-site Scripting (XSS) - Stored · Glassdoor
    133 votes
88. Stored XSS on byddypress Plug-in via groups nameCross-site Scripting (XSS) - Stored · low · WordPress
    132 votes
89. Possible XSS vulnerability without a content security bypassCross-site Scripting (XSS) - Generic · medium · Stripe
    $2,000131 votes
90. [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameterCross-site Scripting (XSS) - Stored · high · Uber
    $3,000131 votes
91. Stored XSS in custom emojiCross-site Scripting (XSS) - Stored · high · GitLab
    $3,000130 votes
92. Stored XSS in 'Notes'Cross-site Scripting (XSS) - Stored · Visma Public
    $250130 votes
93. Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comCross-site Scripting (XSS) - Generic · medium · HackerOne
    129 votes
94. Reflected XSS In Marketing Reports Page On *.myshopify.com/adminCross-site Scripting (XSS) - Reflected · medium · Shopify
    128 votes
95. Stored XSS when uploading files to an invoiceCross-site Scripting (XSS) - Stored · Visma Public
    $250128 votes
96. Stored Cross-Site Scripting found in custom integration app on https://admin.b360.autodesk.com.Cross-site Scripting (XSS) - Stored · medium · Autodesk
    127 votes
97. Stored XSS in Document TitleCross-site Scripting (XSS) - Generic · medium · Localize
    $50124 votes
98. XSS via referrer parameterCross-site Scripting (XSS) - Reflected · medium · X / xAI
    124 votes
99. Stored XSS in private messageCross-site Scripting (XSS) - Stored · medium · Shopify
    $1,000124 votes
100. Stored XSS in localhost:* via integrated torrent downloaderCross-site Scripting (XSS) - Stored · medium · Brave Software
     124 votes