Browse / Cross-site Scripting

Cross-site Scripting

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cross-site Scripting (XSS) - Generic1,048
• Cross-site Scripting (XSS) - Reflected674
• Cross-site Scripting (XSS) - Stored663
• Cross-site Scripting (XSS) - DOM182
• Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)17
• Cross-Site Scripting (XSS)2
• Reflected XSS1

Often found together with

• Cross-Site Request Forgery148
• Authentication125
• Misconfiguration122
• Information Disclosure120
• Code Execution86
• Access Control72
• Injection and Smuggling52
• Open Redirect48

Most upvoted Cross-site Scripting reports

AllValidInformativeN/ADuplicate

1. [airbnb.com] XSS via Cookie flashDuplicateCross-site Scripting (XSS) - Generic · medium · Airbnb
   17 votes
2. Stored XSS in Name of Team Member InvitationDuplicateCross-site Scripting (XSS) - Stored · low · Localize
   15 votes
3. Html Injection and Possible XSS via MathMLDuplicateCross-site Scripting (XSS) - Generic · critical · X / xAI
   13 votes
4. Torrent extension: Cross-origin downloading + "URL spoofing" + CSP-blocked XSSDuplicateCross-site Scripting (XSS) - Generic · medium · Brave Software
   12 votes
5. XSS via SVG fileDuplicateCross-site Scripting (XSS) - Generic · medium · Ubiquiti Inc.
   9 votes
6. Stored Cross site scriptingDuplicateCross-site Scripting (XSS) - Generic · Eternal
   9 votes
7. Cross-site Scripting (XSS) possible at https://sifchain.finance// via CVE-2019-8331 exploitationDuplicateCross-site Scripting (XSS) - Generic · medium · Sifchain
   6 votes
8. CORS (Cross-Origin Resource Sharing) origin validation failure -Any website can issue requests made with user credentials and read the responses to thDuplicateCross-site Scripting (XSS) - Stored · Sifchain
   5 votes
9. XSS by MathML at Active StorageDuplicateCross-site Scripting (XSS) - Stored · medium · Ruby on Rails
   5 votes
10. muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical · Uber
    5 votes
11. Stored xssDuplicateCross-site Scripting (XSS) - Generic · ownCloud
    5 votes
12. Self-XSS Vulnerability on Password Reset FormDuplicateCross-site Scripting (XSS) - Generic · Uber
    5 votes
13. XSS in people.uber.comDuplicateCross-site Scripting (XSS) - Generic · Uber
    4 votes
14. XSS in Subtitles of Vimeo Flash Player and Hubnut DuplicateCross-site Scripting (XSS) - Generic · Vimeo
    4 votes
15. udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical · Uber
    3 votes
16. lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical · Uber
    3 votes
17. SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical · Uber
    3 votes
18. SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js EndpointDuplicateCross-site Scripting (XSS) - Reflected · critical · Uber
    3 votes
19. SSL-protected Reflected XSS in m.uber.comDuplicateCross-site Scripting (XSS) - Reflected · critical · Uber
    3 votes
20. Reflected XSSDuplicateCross-site Scripting (XSS) - Generic · GoCD
    3 votes
21. HTML injection via 'underlying' parameterDuplicateCross-site Scripting (XSS) - Generic · Deriv.com
    3 votes
22. 4 xss vulnerability dom based cwe 79 ; wordpress bootstrap.min.js is vulnerableDuplicateCross-site Scripting (XSS) - DOM · medium · Sifchain
    2 votes
23. Reflected XSS vulnerability in a DoD website DuplicateCross-site Scripting (XSS) - Generic · U.S. Dept Of Defense
    2 votes
24. Stored XSS vulnerability on a DoD websiteDuplicateCross-site Scripting (XSS) - Generic · U.S. Dept Of Defense
    2 votes
25. Reflected Self-XSS Vulnerability in the Comment section of Files (Different-payloads)DuplicateCross-site Scripting (XSS) - Generic · Nextcloud
    2 votes
26. XSSDuplicateCross-site Scripting (XSS) - Generic · Deriv.com
    2 votes
27. Self-XSS in Partners ProfileDuplicateCross-site Scripting (XSS) - Generic · Uber
    1 votes
28. XSS in Blog DuplicateCross-site Scripting (XSS) - Generic · drchrono
    1 votes
29. XSS on love.uber.comDuplicateCross-site Scripting (XSS) - Generic · Uber
    1 votes
30. Reflected Cross Site Script in imtportal.gm.comDuplicateCross-site Scripting (XSS) - Generic · General Motors
    1 votes