Cross-Site Scripting
Injecting attacker-controlled script into a page that a victim's browser then executes with the victim's own privileges.
Cross-Site Scripting is a vulnerability class where an attacker gets their own script to run inside a page in a victim's browser, under that page's own origin — meaning the script can read cookies, make authenticated requests, and manipulate the Document Object Model exactly as the site's legitimate code could. The attacker never touches the victim's session directly; they trick the victim's own browser into running code on their behalf.
The three variants differ in where the malicious payload lives. Stored XSS persists the payload server-side — a comment field, a profile bio — so it executes for every visitor who views that content, which is why it's the most dangerous variant: one injection, many victims, no interaction required beyond viewing a page. Reflected XSS bounces the payload off the server in a single response, typically via a URL parameter echoed back unescaped, requiring the victim to click a crafted link. DOM-based XSS never touches the server at all — client-side script reads something attacker-controlled, like location.hash, and writes it into the page unsafely, so the vulnerability lives entirely in front-end code a server-side scanner won't see.
The root cause across all three is the same: untrusted input rendered into a context — HTML, a script tag, an attribute — without escaping appropriate to that context. The fix is equally uniform: escape on output, at the point data crosses into HTML, not on input, since data legitimately used in multiple contexts needs different escaping for each. Modern frameworks that auto-escape interpolated values by default (React's JSX, Vue's templates) close most of the surface automatically; dangerouslySetInnerHTML and its equivalents exist precisely to name the escape hatch, so a reviewer can spot it.
Content Security Policy is the layer that limits damage after an injection succeeds anyway — it's a mitigation, not a substitute for escaping.
See also4
Form Validation
Checking what people type into a web form before accepting it, done in the browser for fast feedback and on the server for safety, and harder than it looks because real names, addresses, and numbers break simple rules.
Web Platform11 connections
Same-Origin Policy
The browser rule isolating documents by scheme, host, and port, and the mechanisms for relaxing it.
Web Platform30 connections
Cross-Origin Resource Sharing
The mechanism by which a server opts in to letting scripts on other origins read its responses.
Web Platform9 connections
Cross-Site Request Forgery
Tricking a logged-in user's browser into sending a state-changing request to another site, which works because the browser attaches that site's cookies automatically.
Web Platform14 connections
Related7
Nearby in the graph rather than deliberately chosen. Looser, sometimes surprising.
Linked from20
- ANSI Escape CodeSystems & Tooling
The in-band byte sequences, starting with the escape character, that tell a terminal to move the cursor, change color, or clear the screen, inherited from 1970s video terminals and still how every command-line tool draws.
- ClickjackingWeb Platform
Tricking a user into clicking something on another site by loading it invisibly in a frame beneath a decoy, and the headers that stop a page from being framed.
- Content Security PolicyWeb Platform
An HTTP header that tells the browser which sources of script, style, and other content a page is allowed to load.
- Cross-Origin Resource SharingWeb Platform
The mechanism by which a server opts in to letting scripts on other origins read its responses.
- Cross-Site Request ForgeryWeb Platform
Tricking a logged-in user's browser into sending a state-changing request to another site, which works because the browser attaches that site's cookies automatically.
- Defensive ProgrammingTesting & Verification
Writing code that anticipates misuse and bad input, checking assumptions and handling the unexpected rather than trusting callers, along with the debate over when defense should give way to failing loudly.
- FirewallNetworks & Distribution
A filter that allows or blocks network traffic by rule, the oldest perimeter defense, and less sufficient on its own than it used to be.
- Form ValidationWeb Platform
Checking what people type into a web form before accepting it, done in the browser for fast feedback and on the server for safety, and harder than it looks because real names, addresses, and numbers break simple rules.
- HTTP CookieWeb Platform
A small piece of state a server asks the browser to store and send back on later requests, governed by attributes that decide exactly where it goes.
- JSON Web TokenWeb Platform
A signed, self-contained token that carries claims a server can verify without a database lookup.
- MIME TypeWeb Platform
The short type/subtype label, born in email, that tells a browser how to treat a response, and why browsers that guess when it's missing turned a convenience into a security hole.
- OAuthWeb Platform
A protocol for granting one application limited access to a user's data on another, without handing over the user's password.
- Open RedirectWeb Platform
A page that forwards visitors to whatever address a URL parameter names, letting attackers borrow a trusted domain to launch phishing or steal sign-in tokens, and the narrow ways to fix it.
- PHPWeb Platform
The server-side language that began in 1994 as a personal set of homepage tools, spread on cheap shared hosting to run much of the web including WordPress and early Facebook, and survived years of ridicule by getting much faster and stricter.
- Prototype PollutionWeb Platform
A JavaScript vulnerability where attacker-controlled keys like "__proto__" modify the prototype every object inherits from, silently adding properties everywhere, and how merge utilities and parsers let it in.
- Session ManagementWeb Platform
How a website remembers that a visitor has signed in across otherwise unrelated requests, usually with a random identifier in a cookie, and the attacks that target that identifier.
- SQL InjectionData & Content
An attack in which user input is pasted into a database query and gets run as code, prevented by keeping the query and its data in separate channels.
- Static AnalysisTesting & Verification
Finding bugs by examining code without running it, from linters and type checkers to deep security analysis, always trading missed bugs against false alarms.
- Web StorageWeb Platform
The browser's built-in ways to keep data on the user's device, from the simple string store localStorage to the transactional database IndexedDB, and their limits on size, persistence and security.
- WordPressWeb Platform
The open-source PHP publishing system forked from b2 in 2003 that grew from a blogging tool into the software behind a large share of all websites, held together by themes, plugins, and a strict commitment to backward compatibility.