Link manipulation (DOM-based)
Summary: PortSwigger describes DOM-based link manipulation as a vulnerability that arises when a client-side script reads controllable data from the DOM, such as the URL, and writes it to a navigation target like a clickable link or a form's submission URL. An attacker can construct a URL that, when visited by another user, modifies the targets of links in the response, and Burp Suite flags the issue through dynamic and static code analysis, though static analysis alone can produce false positives.
What you should know: The source notes that static analysis can flag issues that are not actually exploitable, so a scanner finding without dynamic evidence leaves you reviewing code and execution paths to confirm whether the vulnerability is real or already mitigated.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026