Cross-site scripting
Also called: XSS
A flaw where a website includes user-supplied input in its pages without proper encoding, letting an attacker run malicious JavaScript in other users' browsers. It can be used to steal sessions, act as the victim or redirect to phishing pages, and is especially damaging in admin consoles. Developers should encode output for its context and add a Content Security Policy to limit the damage.
Further reading: owasp.org
Advisories that mention this term
CISA Adds Microsoft Microsoft Vulnerability CVE-2026-42897 to Known Exploited Vulnerabilities Catalog
On 2026-05-15, CISA added CVE-2026-42897 (Microsoft Microsoft) to its Known Exploited Vulnerabilities (KEV) catalog .
Canvas learning platform breached via XSS from a free teacher account; user data and messages stolen, ransom note planted on login pages
Instructure said the attacker used a Free-for-Teacher account to submit a support ticket with malicious code that triggered an XSS flaw, obtained an authorization token and gained elevated access in Canvas, taking usernames, email addresses, course names, enrollment information and messages .
CISA Adds Cisco Adaptive Security Appliance (ASA) Vulnerability CVE-2014-2120 to Known Exploited Vulnerabilities Catalog
On 2024-11-12, CISA added CVE-2014-2120 (Cisco Adaptive Security Appliance (ASA)) to its Known Exploited Vulnerabilities (KEV) Catalog .