脆弱性（CVE）
共通脆弱性識別子（CVE）
脆弱性一覧
すべてのCVE
CISA - 悪用された脆弱性
OWASP - 脆弱性
カテゴリ別CVE
ベンダーで検索
製品で検索
年別ソート
CVE 2026
CVE 2025
CVE統計
年/月別CVE
カテゴリ別CVE
OWASP別CVE
CVSSスコア別CVE
CVEを持つベンダー TOP 100
CVEを持つ製品 TOP 100
特定ビュー
CVE 緊急スコア
CVE EPSS > 70%
CVE 高スコア
CVE ネットワーク（ベクター）
CVE ローカル（ベクター）
CVE 物理（ベクター）
CVE
CVEは「共通脆弱性識別子」の略で、公開されたコンピューターセキュリティの欠陥の一覧です。
OWASP
OWASP Top 10は、ウェブアプリケーションにおける上位10件のセキュリティ脆弱性を特定・文書化するイニシアティブです。
CISA KEV
CISA既知の悪用された脆弱性（KEV）は、悪用が確認された脆弱性の一覧を特定・公表するイニシアティブです。
メーカーと製品（CPE）
ベンダーと製品
ベンダー一覧
すべてのベンダー
CVEを持つベンダー TOP 100
製品一覧
すべての製品
CVEを持つ製品 TOP 100
CPEは「共通プラットフォーム列挙」の略で、ハードウェア、ソフトウェア、オペレーティングシステムの命名に関する標準化されたスキームです。CPEはベンダー、製品名、バージョン、アップデート、エディション、言語などの属性に基づいて情報技術システム、プラットフォーム、パッケージを一意に識別・分類するための体系的な命名スキームを提供します。
弱点（CWE）
共通脆弱性タイプ一覧（CWE）
CWE一覧
すべてのCWE
CWEビュー
CWEカテゴリ
特定ビュー
CWE Top 25（2023）
CWE Top 25（2022）
CWE Top 25（2021）
ソフトウェア開発
ハードウェア設計
研究概念
最新5件のCWE
CWE-1463
(2026-10-28 00:00 +00:00)
CWE-1462
(2026-10-28 00:00 +00:00)
CWE-1466
(2026-10-28 00:00 +00:00)
CWE-1465
(2026-10-28 00:00 +00:00)
CWE-1464
(2026-10-28 00:00 +00:00)
CWEは「共通脆弱性タイプ一覧」の略で、ソフトウェアの弱点と脆弱性の包括的な一覧および分類です。アーキテクチャ、設計、コード、実装における脆弱性につながる可能性のあるソフトウェアセキュリティの弱点を説明するための共通言語として機能します。
攻撃パターン（CAPEC）
共通攻撃パターン列挙および分類（CAPEC）
CAPEC一覧
すべてのCAPEC
CAPECビュー
CAPECカテゴリ
特定ビュー
攻撃メカニズム
攻撃ドメイン
WASC 脅威分類 2.0
ATT&CK 関連パターン
OWASP 関連パターン
最新5件のCAPEC
CAPEC-701
(2023-01-24 00:00 +00:00)
CAPEC-700
(2023-01-24 00:00 +00:00)
CAPEC-702
(2023-01-24 00:00 +00:00)
CAPEC-699
(2023-01-24 00:00 +00:00)
CAPEC-691
(2022-09-29 00:00 +00:00)
CAPECは「共通攻撃パターン列挙および分類」の略で、サイバー攻撃において攻撃者が使用する一般的な攻撃パターンを文書化した包括的な公開リソースです。このナレッジベースは、一般的な脆弱性と攻撃者がそれを悪用する方法を理解し表現することを目的としています。
サービスと料金
料金とライセンス
アカウントを作成
ヘルプと情報
FAQ・ヘルプ
ブログ・記事
データベースパートナー
お問い合わせ
検索：CVE ID、CWE ID、CAPEC ID、ベンダー名、またはCVEのキーワード
最近の検索：
結果が見つかりませんでした
別のクエリで再度お試しください
日本語
English
Français
Deutsch
Español
Italiano
Português
Nederlands
Polski
日本語
简体中文
繁體中文
한국어
Bahasa Indonesia
Tiếng Việt
ライト
ダーク
システム
CVE Find - アラートシステム
常に最新情報をお届けします
無料アカウントを作成
無料アカウントを開く
アカウントにログイン
アラートを管理する
CVE-2025-31136 : 詳細
ホーム
共通脆弱性識別子（CVE）
CVE-2025-31136 : 詳細
CVE-2025-31136
スコア / 深刻度
6.7
/
中
EPSS
0.23%
V4
公開日
2025-06-04
19h42
+00:00
カテゴリ
Cross-site Scripting
OWASP
A03-Injection
ベクター
Network
更新日
2025-06-04
20h18
+00:00
公式リンク
CVE.org
NVD
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
通知を管理する
カスタムアラート
パーソナライズアラートを有効にしましょう！
アラートを有効にするには、
無料アカウント
にログインするだけです。まだログインしていない場合は、以下のいずれかのオプションを選択してください。
アカウントにログイン
無料アカウントを作成
特定のCVEの通知
特定のCVEの変更情報をいち早くお届けします。
アラート送信の基準：前回のアラートとの比較で、CISA、EPSS、CVSS、CWE、対策、CPEに差異がある場合。
パラメーター
送信されるアラートに表示されるタイトルを指定できます。
CVE IDを入力してください（例：CVE-2025-1234）
スケジュール
送信頻度
上位プランが必要です
毎時
公開への即時反応
上位プランが必要です
毎日
選択した曜日のメール
上位プランが必要です
毎週
選択した曜日のまとめ
毎月
月次レポート
時間
毎時
15分ごと (上位プランが必要です)
30分ごと (上位プランが必要です)
分
00
05
10
15
20
25
30
35
40
45
50
55
適用する曜日
月曜日
火曜日
水曜日
木曜日
金曜日
土曜日
日曜日
実行時刻 (UTC)
適用する曜日
月曜日
火曜日
水曜日
木曜日
金曜日
土曜日
日曜日
実行時刻 (UTC)
月
毎月
選択した月
1月
2月
3月
4月
5月
6月
7月
8月
9月
10月
11月
12月
日
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
実行時刻 (UTC)
*
必須項目
every
1
2
3
4
5
6
7
8
9
10
11
12
every
lastday
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
every
1
2
3
4
5
6
7
every
every4
every12
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
every15
every30
0
5
10
15
20
25
30
35
40
45
50
55
作成日
-
最終実行日時
-
次回実行日時
-
CVE の説明
FreshRSS vulnerable to Cross-site Scripting by
'ing a vulnerable same-origin page in a feed entry</h3> FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to run arbitrary JavaScript on the feeds page. This occurs by combining a cross-site scripting (XSS) issue that occurs in `f.php` when SVG favicons are downloaded from an attacker-controlled feed containing `<script>` tags inside of them that aren't sanitized, with the lack of CSP in `f.php` by embedding the malicious favicon in an iframe (that has `sandbox="allow-scripts allow-same-origin"` set as its attribute). An attacker needs to control one of the feeds that the victim is subscribed to, and also must have an account on the FreshRSS instance. Other than that, the iframe payload can be embedded as one of two options. The first payload requires user interaction (the user clicking on the malicious feed entry) with default user configuration, and the second payload fires instantly right after the user adds the feed or logs into the account while the feed entry is still visible. This is because of lazy image loading functionality, which the second payload bypasses. An attacker can gain access to the victim's account by exploiting this vulnerability. If the victim is an admin it would be possible to delete all users (cause damage) or execute arbitrary code on the server by modifying the update URL using fetch() via the XSS. Version 1.26.2 has a patch for the issue. </div> </div> <div class="card card-flush py-4"> <div class="card-header"> <div class="card-title"> <h2>CVE の情報</h2> </div> </div> <div class="card-body pt-0"> <h2 class="tw-h3">関連する弱点</h2> <div class="table-responsive"> <table class="table table-striped gy-7 gs-7"> <thead> <tr class="fw-semibold fs-6 text-gray-800 border-bottom border-gray-200"> <th><nobr>CWE-ID</nobr></th> <th>弱点名</th> <th>出典</th> </tr> </thead> <tbody> <tr> <td><nobr><a href="/ja/cwe/cwe-79.html">CWE-79</a></nobr></td> <td><b>Improper Neutralization of Input During Web Page Generation</b><br>The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.</td> <td></td> </tr> </tbody> </table> </div> <div class="separator my-10"></div> <h3>メトリクス</h3> <div class="table-responsive"> <table class="table table-striped gy-7 gs-7"> <thead> <tr class="fw-semibold fs-6 text-gray-800 border-bottom border-gray-200"> <th>メトリクス</th> <th>スコア</th> <th>深刻度</th> <th>CVSS ベクター</th> <th>出典</th> </tr> </thead> <tbody> <tr> <td>V3.1</td> <td>6.7</td> <td>MEDIUM</td> <td> CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L <div class="m-0"> <div class="d-flex align-items-center collapsible toggle mb-0 collapsed" data-bs-toggle="collapse" data-bs-target="#metric-179411379846718" aria-expanded="false"> <div class="btn btn-sm btn-icon mw-20px btn-active-color-primary me-5"> <i class="ki-duotone ki-minus-square toggle-on text-primary fs-4"> <span class="path1"></span> <span class="path2"></span> </i> <i class="ki-duotone ki-plus-square toggle-off fs-4"> <span class="path1"></span> <span class="path2"></span> <span class="path3"></span> </i> </div> <span class="text-gray-700 cursor-pointer mb-0">詳細情報</span> </div> <div id="metric-179411379846718" class="fs-7 ms-1 collapse" style=""> <div class="mb-4"> <div class="d-flex align-items-center ps-10 mb-n1"> <div class="text-gray-600 fs-7"> <h4 class='bg-light border border-gray-300 rounded p-2'>Base: Exploitabilty Metrics</h4><p>The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.</p><div class='tw-h5' style='padding-left:10px'>Attack Vector</div><p style='padding-left:10px'>This metric reflects the context by which vulnerability exploitation is possible.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Network</p></div><div style='flex: 1;margin-left:5px;'><p>The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).</p></div></div><div class='tw-h5' style='padding-left:10px'>Attack Complexity</div><p style='padding-left:10px'>This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>High</p></div><div style='flex: 1;margin-left:5px;'><p> successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.</p></div></div><div class='tw-h5' style='padding-left:10px'>Privileges Required</div><p style='padding-left:10px'>This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.</p></div></div><div class='tw-h5' style='padding-left:10px'>User Interaction</div><p style='padding-left:10px'>This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Required</p></div><div style='flex: 1;margin-left:5px;'><p>Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Scope Metrics</h4><p>The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.</p><div class='tw-h5' style='padding-left:10px'>Scope</div><p style='padding-left:10px'>Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Unchanged</p></div><div style='flex: 1;margin-left:5px;'><p>An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Impact Metrics</h4><p>The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.</p><div class='tw-h5' style='padding-left:10px'>Confidentiality Impact</div><p style='padding-left:10px'>This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>High</p></div><div style='flex: 1;margin-left:5px;'><p>There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.</p></div></div><div class='tw-h5' style='padding-left:10px'>Integrity Impact</div><p style='padding-left:10px'>This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>High</p></div><div style='flex: 1;margin-left:5px;'><p>There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Availability Impact</div><p style='padding-left:10px'>This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Temporal Metrics</h4><p>The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.</p><h4 class='bg-light border border-gray-300 rounded p-2'>Environmental Metrics</h4><p>These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.</p> </div> </div> </div> </div> </div> </td> <td></td> </tr> <tr> <td>V3.1</td> <td>5.4</td> <td>MEDIUM</td> <td> CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N <div class="m-0"> <div class="d-flex align-items-center collapsible toggle mb-0 collapsed" data-bs-toggle="collapse" data-bs-target="#metric-179411379810184" aria-expanded="false"> <div class="btn btn-sm btn-icon mw-20px btn-active-color-primary me-5"> <i class="ki-duotone ki-minus-square toggle-on text-primary fs-4"> <span class="path1"></span> <span class="path2"></span> </i> <i class="ki-duotone ki-plus-square toggle-off fs-4"> <span class="path1"></span> <span class="path2"></span> <span class="path3"></span> </i> </div> <span class="text-gray-700 cursor-pointer mb-0">詳細情報</span> </div> <div id="metric-179411379810184" class="fs-7 ms-1 collapse" style=""> <div class="mb-4"> <div class="d-flex align-items-center ps-10 mb-n1"> <div class="text-gray-600 fs-7"> <h4 class='bg-light border border-gray-300 rounded p-2'>Base: Exploitabilty Metrics</h4><p>The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.</p><div class='tw-h5' style='padding-left:10px'>Attack Vector</div><p style='padding-left:10px'>This metric reflects the context by which vulnerability exploitation is possible.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Network</p></div><div style='flex: 1;margin-left:5px;'><p>The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).</p></div></div><div class='tw-h5' style='padding-left:10px'>Attack Complexity</div><p style='padding-left:10px'>This metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Privileges Required</div><p style='padding-left:10px'>This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>The attacker requires privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources.</p></div></div><div class='tw-h5' style='padding-left:10px'>User Interaction</div><p style='padding-left:10px'>This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Required</p></div><div style='flex: 1;margin-left:5px;'><p>Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited. For example, a successful exploit may only be possible during the installation of an application by a system administrator.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Scope Metrics</h4><p>The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.</p><div class='tw-h5' style='padding-left:10px'>Scope</div><p style='padding-left:10px'>Formally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Changed</p></div><div style='flex: 1;margin-left:5px;'><p>An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Base: Impact Metrics</h4><p>The Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve.</p><div class='tw-h5' style='padding-left:10px'>Confidentiality Impact</div><p style='padding-left:10px'>This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Integrity Impact</div><p style='padding-left:10px'>This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>Low</p></div><div style='flex: 1;margin-left:5px;'><p>Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.</p></div></div><div class='tw-h5' style='padding-left:10px'>Availability Impact</div><p style='padding-left:10px'>This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.</p><div style='display:flex;padding-left:10px;'><div style='width:70px;'><p class='text-center bg-gray-800 text-gray-100 rounded'>None</p></div><div style='flex: 1;margin-left:5px;'><p>There is no impact to availability within the impacted component.</p></div></div><h4 class='bg-light border border-gray-300 rounded p-2'>Temporal Metrics</h4><p>The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability.</p><h4 class='bg-light border border-gray-300 rounded p-2'>Environmental Metrics</h4><p>These metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.</p> </div> </div> </div> </div> </div> </td> <td>nvd@nist.gov</td> </tr> </tbody> </table> </div> <div class="separator my-10"></div> <h2>EPSS</h2> <div class="mb-4">EPSSは脆弱性が悪用される可能性を予測するスコアリングモデルです。</div> <h3>EPSSスコア</h3> <div>EPSSモデルは0から1（0〜100%）の確率スコアを算出します。スコアが高いほど、脆弱性が悪用される可能性が高いことを示します。</div> <div id="chartEpss"></div> <div style="text-align:center;"> <input type="button" class="" value="値の表を表示" onclick="$(document).ready(function() {$('#chartEpssBoard').slideToggle();});"> </div> <div id="chartEpssBoard" style="display: none;align-content: center;"> <br><table border="1" cellspacing="0" cellpadding="5" class="table table-bordered"><thead><tr><th>日付</th><th>EPSS V0</th><th>EPSS V1</th><th>EPSS V2<br>(> 2022-02-04)</th><th>EPSS V3<br>(> 2025-03-07)</th><th>EPSS V4<br>(> 2025-03-17)</th></tr></thead><tbody><tr><td>2025-06-05</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-06-11</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-16</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-18</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-19</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-20</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-06-23</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-07-06</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-08-11</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-09-08</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2025-10-04</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.07%</td></tr><tr><td>2025-10-31</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.03%</td></tr><tr><td>2025-11-01</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.03%</td></tr><tr><td>2025-11-12</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-11-18</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.08%</td></tr><tr><td>2025-11-21</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2025-12-29</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2026-01-05</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2026-01-07</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.04%</td></tr><tr><td>2026-01-08</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.05%</td></tr><tr><td>2026-02-22</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.09%</td></tr><tr><td>2026-03-01</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.1%</td></tr><tr><td>2026-03-22</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.11%</td></tr><tr><td>2026-04-05</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.3%</td></tr><tr><td>2026-05-17</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.3%</td></tr><tr><td>2026-06-14</td><td>–</td><td>–</td><td>–</td><td>–</td><td>0.23%</td></tr></tbody></table> </div> <h3>EPSSパーセンタイル</h3> <div>パーセンタイルはCVEをEPSSスコアで順位付けするために使用されます。例えば、EPSSスコアで95パーセンタイルにあるCVEは、他の95%のCVEよりも悪用される可能性が高いことを意味します。パーセンタイルはCVEのEPSSスコアを他のCVEと比較するために使用されます。</div> <div id="chartPercentile"></div> <div class="text-center"> <a href="https://www.first.org/epss/" target="_parent">EPSS First.org<i class="ki-duotone ki-exit-right-corner" style="font-size: 10px;vertical-align:8px"><span class="path1"></span><span class="path2"></span></i></a> </div> <div style="text-align:center;"> <input type="button" class="" value="値の表を表示" onclick="$(document).ready(function() {$('#chartPercentileBoard').slideToggle();});"> </div> <div id="chartPercentileBoard" style="display: none;align-content: center;"> <br><table border="1" cellspacing="0" cellpadding="5" class="table table-bordered"><thead><tr><th>日付</th><th>パーセンタイル</th></tr></thead><tbody><tr><td>2025-06-05</td><td>14%</td></tr><tr><td>2025-06-11</td><td>12%</td></tr><tr><td>2025-06-16</td><td>11%</td></tr><tr><td>2025-06-18</td><td>12%</td></tr><tr><td>2025-06-19</td><td>11%</td></tr><tr><td>2025-06-20</td><td>12%</td></tr><tr><td>2025-06-23</td><td>11%</td></tr><tr><td>2025-07-06</td><td>14%</td></tr><tr><td>2025-08-11</td><td>16%</td></tr><tr><td>2025-09-08</td><td>17%</td></tr><tr><td>2025-10-04</td><td>22%</td></tr><tr><td>2025-10-31</td><td>8%</td></tr><tr><td>2025-11-01</td><td>7%</td></tr><tr><td>2025-11-12</td><td>1%</td></tr><tr><td>2025-11-18</td><td>2%</td></tr><tr><td>2025-11-21</td><td>1%</td></tr><tr><td>2025-12-29</td><td>14%</td></tr><tr><td>2026-01-05</td><td>13%</td></tr><tr><td>2026-01-07</td><td>14%</td></tr><tr><td>2026-01-08</td><td>17%</td></tr><tr><td>2026-02-22</td><td>25%</td></tr><tr><td>2026-03-01</td><td>27%</td></tr><tr><td>2026-03-22</td><td>29%</td></tr><tr><td>2026-04-05</td><td>53%</td></tr><tr><td>2026-05-17</td><td>54%</td></tr><tr><td>2026-06-14</td><td>46%</td></tr></tbody></table> </div> <script> var optionsEpss = { chart: { fontFamily: 'inherit', type: 'area', height: 250 }, series: [ {name: 'EPSS V0',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V1',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V2',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V3',data: [null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null]}, {name: 'EPSS V4',data: [0.05,0.04,0.04,0.04,0.04,0.04,0.04,0.05,0.05,0.05,0.07,0.03,0.03,0.04,0.08,0.04,0.04,0.04,0.04,0.05,0.09,0.1,0.11,0.3,0.3,0.23]} ], xaxis: { categories: [1749089468000,1749607867000,1750039873000,1750212665000,1750299068000,1750385484000,1750644682000,1751767884000,1754878270000,1757297465000,1759543862000,1761880269000,1761966672000,1762917067000,1763435462000,1763694665000,1766977864000,1767582682000,1767755476000,1767841874000,1771723241000,1772328050000,1774142449000,1775348450000,1778977249000,1781396456000], type: 'datetime' }, stroke: { curve: 'straight', }, tooltip: { x: { format: 'yyyy-dd-MM' }, y: { formatter: function(value) { if (value!=null) return `${value}%`; } } }, dataLabels: { enabled: true, formatter: function (val) { if (val!=null) return val + '%'; } } }; </script> <script> var optionsPercentile = { chart: { fontFamily: 'inherit', type: 'area', height: 250 }, series: [{ name: 'Percentile', data: [14,12,11,12,11,12,11,14,16,17,22,8,7,10,20,10,14,13,14,17,25,27,29,53,54,46] }], xaxis: { categories: [1749089468000,1749607867000,1750039873000,1750212665000,1750299068000,1750385484000,1750644682000,1751767884000,1754878270000,1757297465000,1759543862000,1761880269000,1761966672000,1762917067000,1763435462000,1763694665000,1766977864000,1767582682000,1767755476000,1767841874000,1771723241000,1772328050000,1774142449000,1775348450000,1778977249000,1781396456000], type: 'datetime' }, stroke: { curve: 'straight', }, tooltip: { x: { format: 'yyyy-dd-MM' }, y: { formatter: function(value) { if (value!=null) return `${value}%`; } } }, dataLabels: { enabled: true, formatter: function (val) { if (val!=null) return val + '%'; } } }; </script> <div class="separator my-10"></div> <h2 class="tw-h3">関連製品</h2> <h3 class='tw-h4'>構成 0</h3><p>Freshrss>>Freshrss >> Version ～まで（含まない） 1.26.2</p> <div class="separator my-10"></div> <h2 class='tw-h3'>参考資料</h2><div style='margin-bottom: 10px;'><a href='https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr' target='_blank'>https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-f6r4-jrvc-cfmr <i class="ki-duotone ki-exit-right-corner" style="font-size: 10px;vertical-align:8px"><span class="path1"></span><span class="path2"></span></i></a><br><span style='margin-left:20px;'>Tags : x_refsource_CONFIRM</span></div><div style='margin-bottom: 10px;'><a href='https://github.com/FreshRSS/FreshRSS/commit/426e3054c237c2b98667ebeacbbdb5caa88e7b1f' target='_blank'>https://github.com/FreshRSS/FreshRSS/commit/426e3054c237c2b98667ebeacbbdb5caa88e7b1f <i class="ki-duotone ki-exit-right-corner" style="font-size: 10px;vertical-align:8px"><span class="path1"></span><span class="path2"></span></i></a><br><span style='margin-left:20px;'>Tags : x_refsource_MISC</span></div><div class="separator my-10"></div> </div> </div> </div> </div> </div> </div> <!--end::Container--> <!--begin::Footer--> <div class="footer py-4 d-flex flex-lg-column" id="kt_footer"> <div class="container-xxl d-flex flex-column flex-md-row align-items-center justify-content-between"> <div class="text-gray-900 order-2 order-md-1"> <span class="text-muted fw-semibold me-1">2026©</span> <a href="https://www.tesweb.com" target="_blank" class="text-gray-800 text-hover-primary">tesweb SA</a>, <a href="https://www.bexxo.ch" target="_blank" class="text-gray-800 text-hover-primary">bexxo Cyber Security</a> </div> <ul class="menu menu-gray-600 menu-hover-primary fw-semibold order-1"> <li class="menu-item"> <a href="/ja/official.html" class="menu-link px-2">データ提供元</a> </li> <li class="menu-item"> <a href="/ja/gdpr.html" class="menu-link px-2">GDPR</a> </li> <li class="menu-item"> <a href="#" id="gdpr-manage-cookies" class="menu-link px-2">クッキーを管理する</a> </li> <li class="menu-item"> <a href="/ja/contact.html" class="menu-link px-2">お問い合わせ</a> </li> <li class="menu-item"> <a href="/ja/plan-price.html" class="menu-link px-2">購入</a> </li> <li class="menu-item"> <a href="https://www.linkedin.com/company/cve-find/" class="menu-link px-2" target="_blank"><img src="/media/social/linkedin.svg" width="40" height="40" alt="LinkedIn Account"/></a> </li> <li class="menu-item"> <a href="https://www.facebook.com/people/CVE-Find-Alert/61561116452093/" class="menu-link px-2" target="_blank"><img src="/media/social/facebook.svg" width="40" height="40" alt="Facebook Account"/></a> </li> <li class="menu-item"> <a href="https://x.com/cvefindcom" class="menu-link px-2" target="_blank"><img src="/media/social/twitter.svg" width="40" height="40" alt="Twitter Account"/></a> </li> </ul> </div> </div> <div class="footer py-4"> <div class="container-xxl align-items-center justify-content-between"> CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータは<a href="https://cve.mitre.org/" target="_blank">MITRE Corporation</a>および<a href="https://nvd.nist.gov/" target="_blank">国家脆弱性データベース（NVD）</a>が提供しています。既知の悪用された脆弱性（KEV）カタログは<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">サイバーセキュリティ・インフラセキュリティ庁（CISA）</a>から、EPSSスコアは<a href="https://www.first.org/epss/" target="_blank">FIRST.org</a>から取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータは<a href="https://mitre.org/" target="_blank">MITRE Corporation</a>が管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報は<a href="https://nvd.nist.gov/products/cpe" target="_blank">NVD</a>が提供しています。 </div> </div> </div> </div> </div> <!--begin::Javascript--> <script>var hostUrl = "assets/";</script> <script src="/plugins/global/plugins.bundle.min.1743008562.js"></script> <script src="/js/scripts.bundle.1718974735.js"></script> <script src="/js/app/custom.min.1788264851.js"></script> <script src="/js/app/base.ja.min.1793721674.js" defer></script> <script src="/plugins/custom/datatables/datatables.bundle.1718974031.js"></script> <script src="/js/aceeditor/ace.1715679271.js"></script> <script src="/js/app/bloc/cve/epss.min.1738322185.js"></script> <script src="/js/app/bloc/cve/exploitdb.min.1738322201.js"></script> <script src="/js/app/account/manageAlertNeedAccount.min.1782998772.js" defer></script> <div class="ea-slot d-lg-none" data-ea-anchor="mobile" data-ea-pub="cvefindcom" data-ea-type="text" data-ea-style="fixedfooter" data-ea-kw="security|cybersecurity|vulnerability|cve"></div> <style> /* Encart EthicalAds centré dans son emplacement */ .ea-slot [data-ea-publisher]{margin-left:auto;margin-right:auto;} /* Format horizontal : remplit la largeur de la colonne (variable officielle EthicalAds) */ .ea-slot [data-ea-publisher].horizontal{--ea-image-placement-width-horizontal:100%;} </style> <script async src="https://media.ethicalads.io/media/client/ethicalads.min.js"></script> <script src="/js/app/ads/ethicalads.min.1792667231.js" defer></script> </body> </html> <script> var cookieTimezoneBrowser = function () { let timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone; var offset = -new Date().getTimezoneOffset(); var prefix = offset >= 0 ? '+' : '-'; var timezoneOffset = prefix + Math.floor(Math.abs(offset) / 60).toString().padStart(2, '0') + ':' + (Math.abs(offset) % 60).toString().padStart(2, '0'); document.cookie = "tw-browser=" + timeZone+"|"+ timezoneOffset+ "; path=/"; } cookieTimezoneBrowser(); </script>
