{
  "id": 4994982,
  "title": "Cross-Site Scripting",
  "url": "https://urgent.news/2026/09/02/cross-site-scripting",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-02T02:23:59.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hoax3/cross-site-scripting-108e"
  },
  "original_language": "en",
  "account": "Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. There are three main types of XSS: Reflected, Stored, and DOM-based.\n\nReflected XSS occurs when an attacker injects malicious scripts into a web application's response to a user's request. For example, an attacker could construct a URL like https://insecure-website/search?term=script/* insert bad stuff here *//script to trick the website into displaying the injected script.\n\nStored XSS, also known as Second-order or persistent XSS, happens when a web application stores malicious scripts submitted by users and later displays them to other users. For instance, if a website allows users to submit comments on blog posts and stores these comments in its database, an attacker could submit a comment containing a malicious script. When another user views the comment, the script will be executed.\n\nDOM-based XSS arises when JavaScript code takes data from an attacker-controllable source, such as the URL, and passes it to a sink that supports dynamic code execution. This allows attackers to execute arbitrary JavaScript code, potentially hijacking other users' accounts.\n\nTo exploit DOM-based XSS, attackers need to place data into a source so that it gets propagated to a sink, causing the execution of malicious JavaScript. Common sources for DOM XSS include the URL, which can be accessed using the window.location object. Attackers can construct a link with a payload in the query string or fragment portions of the URL to deliver the payload to a vulnerable page.\n\nTwo other forms of XSS are DOM Sinks and Sources, Testing XSS, and Content Security Policy (CSP). DOM sinks and sources refer to the places within a web page where JavaScript code can be executed. Testing XSS involves identifying the XSS context, which is the location within the response where attacker-controllable data appears. CSP is a browser mechanism that aims to mitigate the impact of XSS and other vulnerabilities. However, it can sometimes be bypassed, enabling the exploitation of the underlying vulnerability.",
  "summary": "Cross-Site Scripting Reflected XSS Arises when an application receives data in an HTTP requrest and includes that data within the immediate response in an unsafe way. # Site has a user-supplied search term in a n a URL: https://insecure-website/search?term = gift # Reflected XSS allows an attacker to construct an attack like this: https://insecure-website/search?term = <script>/ * insert bad…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}