Cross-Site Scripting (XSS)

Client-side script injection into legitimate web application sessions viewed by other users.

Core Principles & Analysis

• Executes malicious JavaScript in victim web browsers.
• Steals session tokens, cookies, and credentials.
• Mitigated using Content Security Policy (CSP) headers.

Specifications & Metrics

• CWE: CWE-79
• IMPACT: High