Java Script injection (reflected DOM-based)
Summary: Reflected DOM-based JavaScript injection occurs when data from a request is echoed into the immediate response inside a part of the DOM that a client-side script then processes unsafely, letting an attacker control a JavaScript string or similar value. An attacker can build a URL that, when visited by another user, executes attacker-supplied JavaScript in that user's browser within their session with the application, enabling theft of session tokens or login credentials, arbitrary actions on the victim's behalf, and keystroke logging.
What you should know: The payload runs inside the victim's authenticated session, so a single crafted link can hand over session tokens or credentials without the user installing anything. PortSwigger also notes that static analysis alone produces false positives, so a scanner finding without dynamic evidence still needs code and execution-path review before you can call it exploitable or closed.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026