Link manipulation (stored DOM-based)
Summary: PortSwigger describes stored DOM-based link manipulation as a vulnerability where user input is stored and later embedded into the DOM, then processed unsafely by a client-side script. DOM-based link manipulation occurs when a script writes controllable data to a navigation target such as a clickable link or a form's submission URL, letting an attacker construct a URL that modifies link targets for other users who visit it.
Key Takeaway: Burp Scanner flags this issue through static analysis that can produce false positives, so without dynamic-analysis evidence someone has to review the code and execution paths by hand to confirm whether the flaw is real or already mitigated.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026