THREAT‑WATCH
Glossary
Cross-Site Scripting (XSS)
An attack that injects malicious scripts into web pages viewed by other users, running in their browser with their permissions.
XSS lets an attacker execute code in a victim's browser session, commonly used to steal session cookies, redirect users to phishing pages, or perform actions on the victim's behalf without their knowledge. It exploits websites that don't properly sanitize user-submitted content before displaying it back to other visitors, a very common web application flaw.