XSS

Cross-Site Scripting

Attack injecting malicious scripts into pages viewed by other users.

When you'd see it: Web application security reviews. XSS is a perennial top web vulnerability.

Why it matters: XSS injects malicious scripts into a page that then run in other users' browsers, stealing sessions or data. The defense is escaping and sanitizing anything user-supplied before it renders.

Common mistakes: Confusing XSS with CSRF. XSS runs attacker code in the victim's browser. CSRF abuses an existing logged-in session. Different attacks, different fixes.