Browse / Cross-site Scripting

Cross-site Scripting

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Cross-site Scripting (XSS) - Generic1,048
• Cross-site Scripting (XSS) - Reflected674
• Cross-site Scripting (XSS) - Stored663
• Cross-site Scripting (XSS) - DOM182
• Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)17
• Cross-Site Scripting (XSS)2
• Reflected XSS1

Often found together with

• Cross-Site Request Forgery148
• Authentication125
• Misconfiguration122
• Information Disclosure120
• Code Execution86
• Access Control72
• Injection and Smuggling52
• Open Redirect48

Most upvoted Cross-site Scripting reports

AllValidInformativeN/ADuplicate

1. Stored XSS in Wiki pagesCross-site Scripting (XSS) - Stored · high · GitLab
   633 votes
2. Stored XSS on imgur profileCross-site Scripting (XSS) - Stored · medium · Imgur
   614 votes
3. The return of the ＜Cross-site Scripting (XSS) - Stored · high · Rockstar Games
   $1,000576 votes
4. [Grab Android/iOS] Insecure deeplink leads to sensitive information disclosureCross-site Scripting (XSS) - Generic · high · Grab
   552 votes
5. XSS in steam react chat clientCross-site Scripting (XSS) - Stored · critical · Valve
   $7,500499 votes
6. Reflected XSS in OAUTH2 login flow Cross-site Scripting (XSS) - Reflected · medium · LY Corporation
   $1,990489 votes
7. Cross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationCross-site Scripting (XSS) - Reflected · high · TikTok
   473 votes
8. XSS vulnerable parameter in a location hashCross-site Scripting (XSS) - Generic · Slack
   455 votes
9. Blind XSS on image uploadCross-site Scripting (XSS) - Stored · critical · CS Money
   $1,000450 votes
10. Stored XSS VulnerabilityCross-site Scripting (XSS) - Stored · high · WordPress
    403 votes
11. [accounts.reddit.com] Redirect parameter allows for XSSCross-site Scripting (XSS) - Generic · high · Reddit
    $5,000394 votes
12. Reflected XSS on www.hackerone.com and resources.hackerone.comCross-site Scripting (XSS) - Reflected · low · HackerOne
    $500387 votes
13. HEY.com email stored XSSCross-site Scripting (XSS) - Stored · critical · Basecamp
    $5,000360 votes
14. Blind XSS on Twitter's internal Big Data panel at █████████████Cross-site Scripting (XSS) - Stored · critical · X / xAI
    357 votes
15. Reflected XSS in TikTok endpointsCross-site Scripting (XSS) - Reflected · medium · TikTok
    356 votes
16. Stored XSS in wordpress.comCross-site Scripting (XSS) - Stored · high · Automattic
    356 votes
17. XSS while logging using GoogleCross-site Scripting (XSS) - Reflected · Shopify
    $1,750341 votes
18. Stored XSS in Private Message component (BuddyPress)Cross-site Scripting (XSS) - Stored · critical · WordPress
    337 votes
19. Stored XSS in my staff name fired in another your internal panelCross-site Scripting (XSS) - Stored · high · Shopify
    326 votes
20. DOM XSS on duckduckgo.com searchCross-site Scripting (XSS) - DOM · high · DuckDuckGo
    326 votes
21. yelp.com XSS ATO (via login keylogger, link Google account)Cross-site Scripting (XSS) - Generic · high · Yelp
    324 votes
22. Stored XSS in markdown via the DesignReferenceFilter Cross-site Scripting (XSS) - Stored · critical · GitLab
    $16,000317 votes
23. Reflected XSSCross-site Scripting (XSS) - Reflected · critical · Bumble
    $1,000317 votes
24. Stored-XSS-ads.tiktok.comCross-site Scripting (XSS) - Stored · low · TikTok
    310 votes
25. Stored XSS via Kroki diagramCross-site Scripting (XSS) - Stored · high · GitLab
    $13,950295 votes
26. Account takeover through the combination of cookie manipulation and XSSCross-site Scripting (XSS) - Stored · high · Superhuman (formerly Grammarly)
    292 votes
27. RichText parser vulnerability in scheduled posts allows XSSCross-site Scripting (XSS) - Stored · high · Reddit
    $5,000280 votes
28. Stored xss in address field in billing activity at https://shop.aaf.com/Order/step1/index.cfmCross-site Scripting (XSS) - Stored · high · Alliance of American Football
    244 votes
29. XSS at jamfpro.shopifycloud.comCross-site Scripting (XSS) - Generic · medium · Shopify
    $9,400240 votes
30. Cross-site Scripting (XSS) on HackerOne careers pageCross-site Scripting (XSS) - DOM · low · HackerOne
    $500239 votes
31. Reflected XSS on www.hackerone.com via Wistia embed codeCross-site Scripting (XSS) - Reflected · low · HackerOne
    $500236 votes
32. XSS via Direct Message deeplinksCross-site Scripting (XSS) - DOM · X / xAI
    236 votes
33. Stored XSS on reports.Cross-site Scripting (XSS) - Stored · high · X / xAI
    $700232 votes
34. Stored XSS in developer.uber.comCross-site Scripting (XSS) - Generic · Uber
    $7,500223 votes
35. [www.zomato.com] Blind XSS on one of the Admin DashboardCross-site Scripting (XSS) - Generic · high · Eternal
    $750221 votes
36. XSS via Mod Log Removed PostsCross-site Scripting (XSS) - Stored · high · Reddit
    218 votes
37. Account Takeover in Periscope TVCross-site Scripting (XSS) - Generic · high · X / xAI
    213 votes
38. DOM Based XSS in www.hackerone.com via PostMessageCross-site Scripting (XSS) - DOM · low · HackerOne
    $500208 votes
39. Ability to create own account UUID leads to stored XSSCross-site Scripting (XSS) - Stored · high · Upserve
    $1,500207 votes
40. Stored XSS on TikTok AdsCross-site Scripting (XSS) - DOM · medium · TikTok
    201 votes
41. XSS and cache poisoning via upload.twitter.com on ton.twitter.comCross-site Scripting (XSS) - Generic · X / xAI
    198 votes
42. Reflected XSS on Pangle Endpoint Cross-site Scripting (XSS) - Reflected · high · TikTok
    $5,000196 votes
43. H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingCross-site Scripting (XSS) - DOM · high · Shopify
    195 votes
44. XSS STORED AT socialclub.rockstargames.com (add friend request from profile attacker)Cross-site Scripting (XSS) - Stored · medium · Rockstar Games
    194 votes
45. Stored Xss Vulnerability on ████████Cross-site Scripting (XSS) - Stored · high · U.S. Dept Of Defense
    192 votes
46. Markdown parsing issue enables insertion of malicious tags and event handlersCross-site Scripting (XSS) - Stored · high · HackerOne
    $5,000184 votes
47. Reflected Cross site Scripting (XSS) on www.starbucks.comCross-site Scripting (XSS) - Reflected · medium · Starbucks
    181 votes
48. XSS at https://exchangemarketplace.com/blogsearchCross-site Scripting (XSS) - Generic · medium · Shopify
    174 votes
49. RXSS at image.hackerone.live via the `url` parameterCross-site Scripting (XSS) - Reflected · low · HackerOne
    $500171 votes
50. DOM Based XSS via postMessage at https://inventory.upserve.com/login/Cross-site Scripting (XSS) - DOM · high · Upserve
    $2,500171 votes
51. Stored-XSS with CSP-bypass via labels' colorCross-site Scripting (XSS) - Stored · high · GitLab
    169 votes
52. Reflected xss in https://sh.reddit.comCross-site Scripting (XSS) - Reflected · high · Reddit
    $5,000166 votes
53. Stored XSS in Notes (with CSP bypass for gitlab.com)Cross-site Scripting (XSS) - Stored · high · GitLab
    161 votes
54. HTML Injection on TikTok AdsImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low · TikTok
    159 votes
55. XSS in www.shopify.com/markets?utm_source=Cross-site Scripting (XSS) - Reflected · low · Shopify
    159 votes
56. xss on https://www.rockstargames.com/GTAOnline/jp/screens/ Cross-site Scripting (XSS) - Generic · medium · Rockstar Games
    159 votes
57. XSS Reflected on reddit.com via url pathCross-site Scripting (XSS) - Reflected · high · Reddit
    157 votes
58. Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Cross-site Scripting (XSS) - DOM · high · Elastic
    157 votes
59. XSS in gist integrationCross-site Scripting (XSS) - Generic · Slack
    $500157 votes
60. IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifierCross-site Scripting (XSS) - Stored · medium · HackerOne
    $2,500156 votes
61. Stored XSS in SVG file as data: urlCross-site Scripting (XSS) - Stored · medium · Shopify
    $5,300153 votes
62. #1 XSS on watchdocs.indriverapp.comCross-site Scripting (XSS) - Reflected · low · inDrive
    147 votes
63. Stored XSS in IE11 on hackerone.com via custom fields Cross-site Scripting (XSS) - Stored · medium · HackerOne
    146 votes
64. CSRF leads to a stored self xssCross-site Scripting (XSS) - Reflected · low · Imgur
    145 votes
65. XSS reflected on [https://www.pixiv.net]Cross-site Scripting (XSS) - Reflected · medium · pixiv
    $500144 votes
66. DOM XSS in tiktok.com/login via the redirect_url parameterCross-site Scripting (XSS) - DOM · high · TikTok
    140 votes
67. Reflected XSS in twitterflightschool.comCross-site Scripting (XSS) - Reflected · X / xAI
    140 votes
68. Stored XSS via Post Tittle Enabling Non-Privileged User to Privileged User Exploitation on https://forums.autodesk.com/Cross-site Scripting (XSS) - Stored · high · Autodesk
    139 votes
69. Persistent XSS in Note objectsCross-site Scripting (XSS) - Stored · high · GitLab
    $4,500139 votes
70. Reflected XSS at https://www.paypal.com/ppcreditapply/da/usCross-site Scripting (XSS) - Reflected · medium · PayPal
    137 votes
71. Reflected/Stored XSS on duckduckgo.comCross-site Scripting (XSS) - Reflected · high · DuckDuckGo
    135 votes
72. [oem.acronis.com] Reflected Cross Site Scripting Cross-site Scripting (XSS) - Reflected · medium · Acronis
    $100134 votes
73. Stored XSS on byddypress Plug-in via groups nameCross-site Scripting (XSS) - Stored · low · WordPress
    132 votes
74. Possible XSS vulnerability without a content security bypassCross-site Scripting (XSS) - Generic · medium · Stripe
    $2,000131 votes
75. [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameterCross-site Scripting (XSS) - Stored · high · Uber
    $3,000131 votes
76. Stored XSS in custom emojiCross-site Scripting (XSS) - Stored · high · GitLab
    $3,000130 votes
77. Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comCross-site Scripting (XSS) - Generic · medium · HackerOne
    129 votes
78. Reflected XSS In Marketing Reports Page On *.myshopify.com/adminCross-site Scripting (XSS) - Reflected · medium · Shopify
    128 votes
79. Stored Cross-Site Scripting found in custom integration app on https://admin.b360.autodesk.com.Cross-site Scripting (XSS) - Stored · medium · Autodesk
    127 votes
80. Stored XSS in Document TitleCross-site Scripting (XSS) - Generic · medium · Localize
    $50124 votes
81. XSS via referrer parameterCross-site Scripting (XSS) - Reflected · medium · X / xAI
    124 votes
82. Stored XSS in private messageCross-site Scripting (XSS) - Stored · medium · Shopify
    $1,000124 votes
83. Stored XSS in localhost:* via integrated torrent downloaderCross-site Scripting (XSS) - Stored · medium · Brave Software
    124 votes
84. Reflected Cross-site Scripting (XSS) at https://www.tiktok.com/Cross-site Scripting (XSS) - Reflected · high · TikTok
    123 votes
85. Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widgetCross-site Scripting (XSS) - Stored · medium · HackerOne
    122 votes
86. XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"Cross-site Scripting (XSS) - DOM · Shopify
    $3,000121 votes
87. Stored XSS in backup scanning plan nameCross-site Scripting (XSS) - Stored · medium · Acronis
    $500120 votes
88. Reflected XSS on https://inventory.upserve.com/ (affects IE users only)Cross-site Scripting (XSS) - Reflected · medium · Upserve
    $1,200120 votes
89. Stored XSS in File Upload Leads to Privilege Escalation and Full Workspace TakeoverCross-site Scripting (XSS) - Stored · high · Dust
    118 votes
90. Stored XSS vulnerability in comments on *.wordpress.comCross-site Scripting (XSS) - Stored · medium · Automattic
    118 votes
91. A reflected XSS in python/Lib/DocXMLRPCServer.pyCross-site Scripting (XSS) - Reflected · medium · Internet Bug Bounty
    118 votes
92. Stored XSS in Snapmatic + R★Editor commentsCross-site Scripting (XSS) - Stored · high · Rockstar Games
    118 votes
93. Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)Cross-site Scripting (XSS) - Stored · high · Expedia Group Bug Bounty
    117 votes
94. Insecure file upload in xiaoai.mi.com Lead to Stored XSSCross-site Scripting (XSS) - Stored · medium · Xiaomi
    117 votes
95. Reflected XSS on https://www.uber.com Cross-site Scripting (XSS) - Reflected · high · Uber
    114 votes
96. CSP bypass on PortSwigger.net using Google script resourcesCross-site Scripting (XSS) - Reflected · medium · PortSwigger Web Security
    113 votes
97. Reflected xss on ads.tiktok.com using `from` parameter.Cross-site Scripting (XSS) - Reflected · high · TikTok
    112 votes
98. Reflected XSS on help.shopify.comCross-site Scripting (XSS) - Reflected · low · Shopify
    $500111 votes
99. Stored XSS in messagesCross-site Scripting (XSS) - Stored · medium · SideFX
    $500111 votes
100. Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image RenderingCross-site Scripting (XSS) - Reflected · medium · Shopify
     $1,600110 votes