Cross-Site Scripting (XSS)
High · Injection
OWASP Top 10:2025 (current)
A05:2025 — Injection
Historical Top 10:2021 (not current)
A03:2021 — kept for older reports; use 2025 above.
CWE
CWE-79
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A05:2025 · OWASP A03:2021 · CWE-79
Definition
Attacker-controlled script runs in victims' browsers.
Root cause
Untrusted data rendered without context-aware encoding.
Affected components
- HTML templates
- JS sinks
- Rich-text editors
Impact
Session theft, account takeover, defacement.
Severity
High
Safe lab reproduction
PortSwigger Academy XSS labs
Detection methodology
CSP violation reports, DAST, code review.
Evidence examples
- Script alert in lab sink
- CSP violation report
Remediation
Output encoding, Content Security Policy, HttpOnly cookies.
Secure coding examples
Use frameworks that auto-escape; avoid innerHTML/dangerouslySetInnerHTML with user data.
Related CYNARKS lessons & labs
Tools: burp · zap · browser-devtools
Primary 2025 class: A05:2025 — Injection
Practise related skills in Labs or deepen on Academy library.