← Back to glossary
🧨

XSS (Cross‑Site Scripting)

Web Security

Session Hijacking Clickjacking Security Headers Web Application Firewall (WAF)

Client-side code injection in a trusted web origin.

Definition

XSS vulnerabilities allow untrusted input to be interpreted as script in a web origin, enabling data theft, session token exfiltration, and UI manipulation.

In plain English Client-side code injection in a trusted web origin.

Why this matters

Why it matters: XSS can compromise confidentiality and integrity of user interactions and facilitate session hijacking.

Example

Example: Reflected XSS in a search parameter exfiltrating cookies via a malicious payload.