Cross-Site Scripting
Also known as: XSS
Cross-Site Scripting (XSS) is a vulnerability where an attacker injects malicious script into a page viewed by other users — through an unescaped input field, URL parameter, or stored content — letting the script run in victims' browsers with their full session privileges, often to steal cookies or credentials.
Three main variants: stored XSS (malicious script saved in a database, like a comment field, and served to every visitor who views it), reflected XSS (malicious script embedded in a URL and reflected back in the immediate response), and DOM-based XSS (the vulnerability lives entirely in client-side JavaScript, never touching the server at all).
Testing means submitting script payloads into every input that eventually gets rendered back to a page — `` is the classic proof-of-concept — and confirming the application escapes or sanitizes it rather than rendering it as executable code. The core defense is output encoding: treating all user input as data, never as markup, wherever it's displayed.
