Smart DOM XSS Detection in Qualys WAS | Qualys
Summary: Qualys extended its Web Application Scanning product with a new automated mechanism for detecting DOM-based XSS, which it says requires no special setup or knowledge. The method instruments the browser's JavaScript execution engine to track strings passed from sources such as document.URL, cookies and window.location.hash to sinks such as eval, document.write and setTimeout, then confirms suspected findings through an exploitation sub-engine, with results reported under QID 150076.
Why it matters: Qualys states that DOM XSS is fairly common even among top web sites and apps with good security teams, and that classic scanners miss it because the faulty code sits on the client rather than the server. The exploit backtrace names the specific calls in the exploit path, which is what a development team needs to know which code to rewrite.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026