Cross-Site Scripting (XSS)
High · Injection · OWASP A03:2021 · CWE-79
Description
Attacker-controlled script runs in victims' browsers.
Root cause
Untrusted data rendered without context-aware encoding.
Impact
Session theft, account takeover, defacement.
Detection
CSP violation reports, DAST, code review.
Mitigation
Output encoding, Content Security Policy, HttpOnly cookies.
Secure coding
Use frameworks that auto-escape; avoid innerHTML/dangerouslySetInnerHTML with user data.
Safe lab example
PortSwigger Academy XSS labs
Practise related skills in Labs or deepen on Academy library.