Cross-site scripting (XSS)
XSS · cross site scripting · stored XSS · reflected XSS · DOM-based XSS · script injection · faille XSS
A web application flaw that lets an attacker inject JavaScript into a page viewed by other users, and so act inside their browser on their behalf.
In practice
The injected script runs with the victim’s rights on the site: it can hijack their session, alter what they see (a fake login form) or carry out actions in their name. There are three main kinds: stored XSS (the code is saved, for instance in a comment, and hits every visitor), reflected XSS (delivered through a malicious link) and DOM-based XSS (entirely in the browser). It is one of the most widespread flaws: the OWASP Top 10:2025 counts more than 30,000 XSS CVEs, within the Injection category (A05).
Fictional case: on a supplier’s extranet, the “company name” field is not encoded when displayed. An attacker plants a script there; every time an administrator views the list of accounts, the script sends their session to the attacker, who takes over the admin interface.
How to protect yourself
- Encode all displayed data for its context (HTML, attribute, JavaScript, URL).
- Rely on the framework’s automatic escaping and ban its bypass functions.
- Sanitise user-supplied HTML with a proven library.
- Add a Content Security Policy (CSP) and HttpOnly cookies as additional layers.
