Input returned in response (reflected)
Summary: PortSwigger Research describes reflected input as data copied from a request and echoed into the application's immediate response, noting that this is not a vulnerability in its own right. The text states that reflected input is a prerequisite for client-side vulnerabilities including cross-site scripting, open redirection, content spoofing, and response header injection, and that some server-side vulnerabilities such as SQL injection are often easier to identify and exploit when input is returned in responses.
What's compelling: Reflected input is the precondition for cross-site scripting, open redirection, content spoofing, and response header injection, so every place a request value comes back in a response is a candidate entry point. Where input retrieval is rare and a web application firewall resists automated testing, the source recommends subjecting those instances to focused manual testing.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026