Lab: Reflected XSS into HTML context with nothing encoded
Summary: PortSwigger's Web Security Academy lab describes a simple reflected cross-site scripting vulnerability in a site's search functionality, where input is reflected into an HTML context with nothing encoded. The stated solution is to paste <script>alert(1)</script> into the search box and click "Search" to trigger the alert function.
What you should know: The failure here is the absence of any output encoding on reflected input, which is enough for an attacker-supplied script to execute in a victim's browser; the lab's own exploitation path is a single pasted string in a search field.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026