Cross-site scripting (reflected)
Summary: Reflected cross-site scripting occurs when data from a request is copied and echoed into the application's immediate response without safe handling, letting an attacker construct a request that executes their JavaScript in another user's browser within that user's session. The injected code can steal session tokens or login credentials, perform arbitrary actions on the victim's behalf, and log keystrokes, with attackers delivering the crafted request via email or instant-message links, blog comments, or a site that triggers cross-domain requests to the vulnerable application.
What's compelling: PortSwigger notes that in applications such as online banking, cross-site scripting should always be considered high risk, and that a flaw on a domain whose cookies reach more security-critical applications can be used to attack those other systems.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026