Lab: DOM XSS in jQuery selector sink using a hashchange event

Summary: This PortSwigger lab contains a DOM-based cross-site scripting vulnerability on its home page, where jQuery's $() selector function auto-scrolls to a post whose title is passed through the location.hash property. Solving the lab requires delivering an exploit to the victim that calls the print() function in their browser, using a malicious iframe added in the Body section.
Bottom line: The flaw lives in client-side code that reads location.hash and hands it to jQuery's selector, so a crafted URL fragment can execute script in the victim's browser without any server-side request to inspect.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026