Input returned in response (stored)
Summary: PortSwigger Research describes retrieval of stored input as a case where user input is stored and later embedded into the application's responses, which is not a vulnerability in its own right but is a prerequisite for cross-site scripting, open redirection, content spoofing, and response header injection. The text notes that vulnerabilities from stored input retrieval are typically more serious than equivalent reflected ones because they need no separate delivery mechanism, and that automated detection cannot reliably determine whether persisted input can be retrieved by other users, authenticated users only, or only the attacker.
Key Takeaway: Stored input that comes back in responses is the raw material for cross-site scripting and header injection, and because it needs no separate delivery link, ordinary users can be exploited during normal use of the application - while your scanner cannot tell you who else can actually retrieve that data.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026