Browse / Cross-site Scripting

Cross-site Scripting

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cross-site Scripting (XSS) - Generic1,048
• Cross-site Scripting (XSS) - Reflected674
• Cross-site Scripting (XSS) - Stored663
• Cross-site Scripting (XSS) - DOM182
• Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)17
• Cross-Site Scripting (XSS)2
• Reflected XSS1

Often found together with

• Cross-Site Request Forgery148
• Authentication125
• Misconfiguration122
• Information Disclosure120
• Code Execution86
• Access Control72
• Injection and Smuggling52
• Open Redirect48

Most upvoted Cross-site Scripting reports

AllValidInformativeN/ADuplicate

1. 1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizerInformativeCross-site Scripting (XSS) - Generic · medium · Ruby on Rails
   70 votes
2. Reflected XSS on Amazon EC2 InstanceInformativeReflected XSS · high · AWS VDP
   55 votes
3. Basic XSS [WAF Bypasses]InformativeCross-site Scripting (XSS) - Generic · Cloudflare Public Bug Bounty
   $5027 votes
4. BUG XSS IN "ADD IMAGES"InformativeCross-site Scripting (XSS) - Stored · medium · Imgur
   19 votes
5. XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)InformativeCross-site Scripting (XSS) - Stored · medium · Ruby
   16 votes
6. ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754InformativeCross-site Scripting (XSS) - Reflected · medium · Ruby on Rails
   15 votes
7. Reflected Cross Site Scripting (XSS)InformativeCross-site Scripting (XSS) - Reflected · medium · Superhuman (formerly Grammarly)
   11 votes
8. fix(cmd-socketio-server): mitigate cross site scripting attack #2068InformativeCross-site Scripting (XSS) - Reflected · high · Linux Foundation Decentralized Trust
   $10010 votes
9. Stored XSS in assets.txmblr.comInformativeCross-site Scripting (XSS) - Stored · medium · Automattic
   10 votes
10. Cross Site Scripting Vulnerability in fabric-sdk-py source code InformativeCross-site Scripting (XSS) - DOM · Linux Foundation Decentralized Trust
    9 votes
11. XSS on kubernetes-csi.github.io (mdBook)InformativeCross-site Scripting (XSS) - Reflected · medium · Kubernetes
    9 votes
12. CSP : Inline scripts can be insertedInformativeCross-site Scripting (XSS) - Generic · medium · Semmle
    9 votes
13. Dom Xss vulnerabilityInformativeCross-site Scripting (XSS) - DOM · high · Recorded Future
    8 votes
14. xss on bittorrent.comInformativeCross-site Scripting (XSS) - Generic · medium · BTFS
    8 votes
15. Stored 'undefined' Cross-site ScriptingInformativeCross-site Scripting (XSS) - Stored · medium · Khan Academy
    8 votes
16. Self-XSS via location cookie city field when getting suggestions for a new locationInformativeCross-site Scripting (XSS) - Generic · Yelp
    8 votes
17. Stored-XSS in merge requestsInformativeCross-site Scripting (XSS) - Reflected · GitLab
    6 votes
18. HTML INJECTION (STORED)InformativeImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · Judge.me
    6 votes
19. XSS on remote.bittorrent.comInformativeCross-site Scripting (XSS) - Generic · medium · BTFS
    6 votes
20. [uppy] Stored XSS due to crafted SVG fileInformativeCross-site Scripting (XSS) - Stored · medium · Node.js third-party modules
    6 votes
21. xssInformativeCross-site Scripting (XSS) - Generic · high · Stellar.org
    6 votes
22. Stored Cross Site Scripting [SELF] in partners.uber.comInformativeCross-site Scripting (XSS) - Generic · Uber
    6 votes
23. XSS exploit of RDoc documentation generated by rdocInformativeCross-site Scripting (XSS) - Stored · medium · Ruby
    5 votes
24. stored xss in scrape-metadata when reading metadata from an html pageInformativeCross-site Scripting (XSS) - Stored · high · Node.js third-party modules
    5 votes
25. Cross Site Scripting In Profile Statement InformativeCross-site Scripting (XSS) - Generic · Gratipay
    5 votes
26. XSS in uber oauthInformativeCross-site Scripting (XSS) - Generic · Uber
    5 votes
27. Possible XSSInformativeCross-site Scripting (XSS) - Generic · HackerOne
    5 votes
28. Stored XSS in RDoc hyperlinks through javascript schemeInformativeCross-site Scripting (XSS) - Stored · medium · Ruby
    4 votes
29. XSS via password recoveringInformativeCross-site Scripting (XSS) - Generic · Uber
    4 votes
30. XSS - URL RedirectsInformativeCross-site Scripting (XSS) - Generic · Shopify
    4 votes
31. XSS On Nextcloud Integrated with zimbra driveInformativeCross-site Scripting (XSS) - Stored · medium · Nextcloud
    3 votes
32. XSS in express-useragent through HTTP User-AgentInformativeCross-site Scripting (XSS) - Generic · Node.js third-party modules
    3 votes
33. Cross-Domain JavaScript Source File Inclusion InformativeCross-site Scripting (XSS) - Generic · low · RubyGems
    3 votes
34. antispambot does not always escape <, >, &, " and 'InformativeCross-site Scripting (XSS) - Generic · low · WordPress
    3 votes
35. Stored XSS in WordPressInformativeCross-site Scripting (XSS) - Stored · medium · WordPress
    3 votes
36. Reflected Cross site scriptingInformativeCross-site Scripting (XSS) - Generic · medium · Veris
    3 votes
37. Critical : Malware and XSS file can be uploaded and executed on udemyInformativeCross-site Scripting (XSS) - Generic · Udemy
    3 votes
38. XSS Via Method injectionInformativeCross-site Scripting (XSS) - Generic · Gratipay
    3 votes
39. Self-XSS on partners.uber.comInformativeCross-site Scripting (XSS) - Generic · Uber
    3 votes
40. doc.owncloud.org: XSS via ReferrerInformativeCross-site Scripting (XSS) - Generic · ownCloud
    3 votes
41. Content spoofingInformativeCross-site Scripting (XSS) - Generic · Phabricator
    3 votes
42. Unchecking hidden parameter is vulnerable to XSS-attackInformativeCross-site Scripting (XSS) - Generic · Khan Academy
    3 votes
43. Prevent XSS when passing a parameter directly into link_to InformativeCross-site Scripting (XSS) - DOM · low · Ruby on Rails
    2 votes
44. Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/InformativeCross-site Scripting (XSS) - Generic · Uber
    2 votes
45. Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modificationInformativeCross-site Scripting (XSS) - Generic · Udemy
    2 votes
46. Pretty Photo Dom XSS InformativeCross-site Scripting (XSS) - Generic · jsDelivr
    2 votes
47. Stored xss in user nameInformativeCross-site Scripting (XSS) - Generic · Mobile Vikings
    2 votes
48. Cross Site ScriptingInformativeCross-site Scripting (XSS) - Generic · Nextcloud
    1 votes
49. XSS found In Your WebInformativeCross-site Scripting (XSS) - Generic · Gratipay
    1 votes
50. Full Page Caching Stored XSS VulnerabilityInformativeCross-site Scripting (XSS) - Generic · Concrete CMS
    1 votes
51. Improper parsing of input could lead to future XSS vulnerabilities in SequencesInformativeCross-site Scripting (XSS) - Stored · low · Mixmax
52. Markdown parsing issue enables insertion of malicious tagsInformativeCross-site Scripting (XSS) - Generic · Gratipay
53. Stored XSSInformativeCross-site Scripting (XSS) - Generic · Udemy