DOM-data manipulation
Summary: DOM-data manipulation vulnerabilities arise when a script writes attacker-controllable data to a DOM field used in the visible UI or client-side logic, letting an attacker build a URL that modifies the appearance or behavior of the client-side UI for anyone who visits it. PortSwigger notes these can be exploited through both reflected and stored DOM-based attacks, ranging from virtual defacement of text or images to changing an element's src property to import a malicious JavaScript file.
Key Takeaway: The severe case is not a cosmetic defacement: an attacker who controls the src property can pull a malicious JavaScript file into the page and induce users to perform unintended actions, and Burp's static analysis flags this issue with possible false positives, so the flagged code and execution paths still need review.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026