The newest Cross-Site Scripting (XSS) resources are on the Cross-Site Scripting (XSS) page. For a reading order instead of a date order, see the Cross-Site Scripting (XSS) learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-11-10 2025 | CVE-2024-13992 Impact Exploitability and Mitigation Steps news | Writeup of CVE-2024-13992, detailing its impact, exploitability, and mitigation steps. This analysis focuses on a cloud vulnerability, offering insights relevant to assessing and strengthening cloud security practices. → wiz.io |
| 2025-11-10 2025 | CVE-2013-10074 Impact Exploitability and Mitigation Steps news | Reference for CVE-2013-10074, detailing its impact, exploitability, and mitigation steps. This vulnerability, documented within the Wiz Cloud Vulnerability Database, highlights potential gaps in cloud security practices. The database aims to provide a community-led resource for understanding and addressing cloud-based threats, offering insights beyond basic security domain assessments. → wiz.io |
| 2025-11-10 2025 | CVE-2024-13993 Impact Exploitability and Mitigation Steps news | Library for identifying and mitigating CVE-2024-13993, a cloud vulnerability. This resource offers detailed analysis, exploitability insights, and practical mitigation steps to safeguard cloud environments against this specific threat. It enables users to assess their security practices and identify defensive gaps. → wiz.io |
| 2025-11-10 2025 | CVE-2018-25119 Impact Exploitability and Mitigation Steps news | Analysis of CVE-2018-25119 details its impact, exploitability, and mitigation steps for cloud security. The Wiz vulnerability database offers free assessments to evaluate cloud security practices across nine domains, identifying defense gaps and benchmarking risk levels, aiming to provide full visibility into cloud workloads. → wiz.io |
| 2025-11-10 2025 | CVE-2021-47689 Impact Exploitability and Mitigation Steps news | Library for understanding CVE-2021-47689, detailing its impact, exploitability, and mitigation steps. This resource focuses on this specific cloud vulnerability, offering insights into how it can be leveraged and how to defend against it. It aims to empower users with the knowledge to assess and address security gaps within their cloud environments. → wiz.io |
| 2025-11-10 2025 | CVE-2025-62076 Impact Exploitability and Mitigation Steps news | Library for researching CVE-2025-62076, detailing its impact, exploitability, and mitigation steps. The entry offers a free vulnerability assessment across nine security domains to benchmark cloud security practices and identify defense gaps. Wiz.io provides this community-led database entry, highlighting its utility for understanding and addressing cloud security vulnerabilities. → wiz.io |
| 2025-11-10 2025 | CVE-2025-62030 Impact Exploitability and Mitigation Steps news | Reference detailing CVE-2025-62030, outlining its impact and exploitability. This entry provides mitigation steps and is part of a community-led vulnerabilities database, offering free assessment across nine security domains to benchmark risk and identify defense gaps. → wiz.io |
| 2025-11-10 2025 | CVE-2025-59556 Impact Exploitability and Mitigation Steps news | Analysis of CVE-2025-59556 details its impact and exploitability within cloud environments. This entry also provides actionable mitigation steps to secure against this specific vulnerability, allowing organizations to assess and improve their cloud security practices across multiple domains and identify potential defense gaps. → wiz.io |
| 2025-11-10 2025 | CVE-2025-62036 Impact Exploitability and Mitigation Steps news | Library for discovering and mitigating CVE-2025-62036 in cloud environments. This resource details the impact and exploitability of the vulnerability, offering practical mitigation steps to secure cloud workloads. It emphasizes achieving full visibility and identifying critical security gaps within cloud infrastructure. → wiz.io |
| 2025-11-06 2025 | CVE-2025-31366 Impact Exploitability and Mitigation Steps news | Library for evaluating cloud security practices, this resource details CVE-2025-31366. It assesses risk levels across nine security domains, identifies defense gaps, and offers a free vulnerability assessment. The database aims to provide full visibility to cloud workloads and validate critical findings. → wiz.io |
| 2025-10-27 2025 | Understanding the Threat of XSS (Cross-Site Scripting) beginner 6 min read | Survey of XSS (Cross-Site Scripting) vulnerabilities, detailing how malicious client-side scripts are injected into web pages. It covers Reflected, Stored, and DOM-Based XSS types, their impact including data theft and account compromise, and mitigation strategies like input validation, output encoding, and regular security audits. Notable attacks like those against British Airways and T-Mobile are mentioned as examples of their significant consequences. |
| 2025-10-24 2025 | The XSS Threat Isnt Going Away beginner | The article discusses the persistent threat of Cross-Site Scripting (XSS) attacks in the digital landscape. Despite advancements in security measures, XSS vulnerabilities remain prevalent and pose a significant risk to web applications. The article emphasizes the importance of continued vigilance and proactive measures to mitigate XSS threats effectively. → hackernoon.com |
| 2025-10-24 2025 | Law Enforcement Cracks Down on XSS but Will It Last? news | Law enforcement is increasing efforts to combat Cross-Site Scripting (XSS) attacks. The effectiveness and longevity of these crackdowns are questioned. → darkreading.com |
| 2025-10-08 2025 | The Brute Art of Bypass - Unfiltered Edition: Master XSS Filter Evasion intermediate 2 min read | Library for bypassing XSS filters and WAFs, detailing systematic probing, backwards and onwards mapping, exploiting post-filter modifications, encoding variations, and keyword fragmentation. Techniques include mixing JavaScript encodings with HTML entities, moving payloads into DOM text, breaking filter context with comment-newline combos, and exploiting regex flaws. It covers methods like character mutation, HTTP Parameter Pollution, tag blending, and HTML vector bypasses, providing explanations for why each technique works against vendors like CloudFlare, Akamai, Imperva, and Fortinet. |
| 2025-08-14 2025 | Cross Site Scripting (XSS) | OWASP Foundation beginner 11 min read | Reference on Cross-Site Scripting (XSS) attacks, detailing how malicious scripts are injected into trusted websites through unvalidated user input. It categorizes attacks into Reflected, Stored, and DOM-Based XSS, outlines consequences like session hijacking and content manipulation, and points to OWASP resources like the XSS Prevention Cheat Sheet and the OWASP ESAPI project for mitigation techniques. The reference also mentions tools such as Nessus and Nikto for vulnerability scanning. → owasp.org |
| 2025-08-14 2025 | Find SSRF , LFI , XSS using httpx , waybackurls , gf , gau , qsreplace intermediate SSRF | The content discusses utilizing tools like httpx, waybackurls, gf, gau, and qsreplace to identify vulnerabilities such as Server-Side Request Forgery (SSRF), Local File Inclusion (LFI), and Cross-Site Scripting (XSS) in web applications. These tools can help security professionals identify and address these common security issues by scanning for them in web applications. |
| 2025-08-14 2025 | How I Found Multiple XSS Vulnerabilities Using Unknown Techniques advanced | The content discusses the discovery of multiple XSS vulnerabilities through the use of undisclosed techniques. It implies that the author has found a method to identify and exploit these vulnerabilities, potentially showcasing a unique approach to uncovering security flaws. The focus is on the process of discovering XSS vulnerabilities rather than detailing specific techniques or findings. → infosecwriteups.com |
| 2025-08-14 2025 | Hunting Blind XSS on the Large Scale — Practical Techniques intermediate 10 min read | Technique for large-scale Blind XSS detection, focusing on identifying vulnerable endpoints through tools like `waymore` and Google Dorking. The methodology involves gathering potential URLs from sources such as the Wayback Machine, filtering them for keywords like "feedback" or "support," and then fuzzing these endpoints with specific payloads designed to bypass WAFs. This approach aids in systematically hunting for Blind XSS vulnerabilities across numerous targets. |
| 2025-08-14 2025 | Mass Hunting Blind XSS Using XSSHunter Express Part 1 intermediate 5 min read | Tool for mass hunting Blind XSS vulnerabilities using XSSHunter Express. This guide details setting up a custom Blind XSS framework with a purchased domain and VPS, covering domain selection, VPS preparation on DigitalOcean, and XSSHunter Express installation via Docker. It also explains how to add custom JavaScript to the server to expedite vulnerability triage, mentioning the use of short domain names and compact payloads as key strategies for effective hunting. |
| 2025-08-14 2025 | A Bunch of Web and XSS Challenges beginner 9 min read | Reference detailing web and XSS challenges, including techniques like copy-paste XSS with AngularJS and connection pooling to delay script loading. It explores exploiting uncommon Content-Type headers such as `text/x,image/gif` and `multipart/mixed` for XSS, and bypassing DOMPurify via `<title>` tag injection and DOM clobbering. The entry also covers leveraging Chrome DevTools Protocol (CDP) and headless mode downloads to achieve XSS and read local files. |
| 2025-08-14 2025 | JS-Tap: Weaponizing JavaScript for Red Teams intermediate 12 min read | Library for red teamers weaponizing JavaScript to attack applications with unknown functionality. JS-Tap provides a generic, unauthenticated payload that instruments the client side, collecting data like IP addresses, OS, browser, typed inputs, URLs visited, cookies, local/session storage, HTML, screenshots, and XHR/Fetch API calls. It operates in "Trap Mode" using an iframe to maintain persistence, or "Implant Mode" by injecting into application JavaScript files. Collected data is accessible via a web-based portal for monitoring and analysis. |
| 2025-08-14 2025 | devanshbatham/Vulnerabilities-Unmasked beginner 14 min read CSRF IDOR | Library of analogies simplifying complex security vulnerabilities including Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), SQL Injection, ClickJacking, Subdomain Takeover, Privilege Escalation, Role-Based Access Control (RBAC) vulnerabilities, Server-Side Request Forgery (SSRF), Vulnerable and Outdated Components, Local File Inclusion (LFI), Denial of Service (DOS), Authentication Bypass, Insecure Direct Object Reference (IDOR), 2FA Bypass, and Race Condition Vulnerability. |
| 2025-08-14 2025 | Mastering XSS: A Comprehensive Guide for Bug Bounty Hunters | by Security L intermediate | The content titled "Mastering XSS: A Comprehensive Guide for Bug Bounty Hunters" by Security L provides detailed information and guidance on mastering Cross-Site Scripting (XSS) for individuals participating in bug bounty programs. It aims to help bug bounty hunters understand and effectively exploit XSS vulnerabilities to enhance their skills in identifying and reporting security issues. The guide likely covers various aspects of XSS attacks, techniques, prevention methods, and practical examples to equip readers with the knowledge needed to excel in finding and addressing XSS vulnerabilities in web applications. → infosecwriteups.com |
| 2025-08-14 2025 | Bypassing character limit XSS using spanned payload intermediate | The content discusses a technique to bypass character limits in Cross-Site Scripting (XSS) attacks using a spanned payload. By breaking the payload into smaller parts and using HTML span tags, attackers can evade character restrictions imposed by input fields, allowing them to execute malicious scripts on vulnerable websites. This method enables the injection of longer payloads while avoiding detection, making it a valuable tool for attackers seeking to exploit XSS vulnerabilities. → infosecwriteups.com |
| 2025-08-14 2025 | XSS bypass for rich text editors intermediate | The content discusses a method to bypass cross-site scripting (XSS) protections in rich text editors. It explains how attackers can exploit vulnerabilities in these editors to execute malicious scripts. By manipulating the editor's features, attackers can inject harmful code and potentially compromise user data. The article highlights the importance of understanding and mitigating XSS vulnerabilities in web applications, especially those using rich text editors. It serves as a warning to developers to implement proper security measures to prevent such attacks and protect user information. |
| 2025-08-14 2025 | Reflected XSS | heli9 beginner | The content provided is a link to a webpage discussing Reflected Cross-Site Scripting (XSS) attacks. Reflected XSS occurs when malicious code is injected into a website and then reflected back to the user. This type of attack can be used to steal sensitive information or perform unauthorized actions on behalf of the user. The webpage likely covers how to prevent and mitigate Reflected XSS attacks to protect websites and users from potential security risks. For more detailed information, it is recommended to visit the provided link. |
| 2025-08-14 2025 | 👩💻IW Weekly #39: $10,000 Bounty, Zero-click Account Takeover, Stored XSS, Open Redirection Vulnerability, SQL… intermediate 3 min read RCE SQLi | Survey of application security articles, threads, videos, and tools, highlighting Facebook Reels crop feature bounty, Zoom stored XSS, Facebook zero-click account takeover, io_uring UAF vulnerability (CVE-2022-2602), Apple open redirection, GraphQL pentesting, social engineering guides, insecure CORS, bug bounty automation, smart contract vulnerabilities, mental health for hackers, HTTP Basic Auth, SQL Injection RCE (CVE-2022-44015), RFC analysis, MMORPG CTF challenge, CodeQL for GraphQL, reconnaissance techniques, SSRF deep dives, and EVM chain vulnerability testing with Foundry. |
| 2025-08-14 2025 | XSS.Report beginner | The content provided is simply the title "XSS.Report." It appears to be a reference to cross-site scripting (XSS) vulnerabilities and reporting related to them. |
| 2025-08-14 2025 | yeswehack/vulnerable-code-snippets: Twitter vulnerable snippets beginner 2 min read SQLi SSRF | Library of vulnerable code snippets for practicing application security analysis, featuring common vulnerabilities such as Broken Access Control (CWE-284), SQL Injection (CWE-89), Cross-Site Scripting (CWE-79), Server-Side Template Injection (CWE-1336), and Deserialization of Untrusted Data (CWE-502). Each snippet includes a Docker setup for safe, isolated execution, with new examples posted weekly on Twitter. |
| 2025-08-14 2025 | Our favourite community contributions to the XSS cheat sheet beginner 2 min read | Reference highlights seven community contributions to the XSS cheat sheet, including @hahwul's missing pointer events, @p4fg's Vue `v-if` vector, @NotSoSecure's AngularJS restriction bypass, @kachakil's AngularJS fix, @davwwwx's attribute injection, @laytonctf's `onbeforeinput` event, and @ladecruze's top-ranked payload using `location`, `atob`, and tagged template strings, with variants utilizing `unescape` and `String.fromCodePoint`. → portswigger.net |
| 2025-08-14 2025 | Chaining self XSS with UI redressing is leading to session hijacking pwn users like a boss intermediate | The content discusses a security vulnerability involving chaining self-cross-site scripting (XSS) with UI redressing, leading to session hijacking. By exploiting this vulnerability, attackers can manipulate user interfaces to trick users into performing actions that compromise their accounts. The article details how this technique can be used to gain unauthorized access to user sessions and provides insights on how to prevent such attacks. |
| 2025-08-14 2025 | XSS to session hijack intermediate | The content discusses how a Cross-Site Scripting (XSS) vulnerability can be exploited to hijack user sessions. It explains the process of injecting malicious scripts into a website to steal session cookies, allowing an attacker to impersonate the victim. The article emphasizes the importance of preventing XSS attacks through proper input validation and output encoding. It also highlights the significance of using secure coding practices to protect against session hijacking and other security threats. |
| 2025-08-14 2025 | ssl/ezXSS: ezXSS is an easy way for penetration testers and bug bounty hunt beginner 2 min read | Tool for testing (blind) Cross-Site Scripting (XSS) vulnerabilities. ezXSS helps penetration testers and bug bounty hunters find and exploit XSS, including persistent sessions with reverse proxy capabilities. It features an easy-to-use dashboard, instant alerts via multiple channels, and collects extensive data from vulnerable pages, supporting all major browsers. |
| 2025-08-14 2025 | How to Write an XSS Cookie Stealer in JavaScript to Steal Passwords « Null intermediate 8 min read | Library for crafting XSS cookie stealers in JavaScript, this resource details how to leverage JavaScript's capabilities to exfiltrate user cookies containing sensitive information like passwords. It walks through setting up a basic HTML environment, injecting malicious JavaScript to capture cookies, and utilizing a simple PHP script on a controlled server to log the stolen data. The guide highlights the technique's effectiveness when combined with code injection and explains how to redirect compromised users to avoid suspicion. → null-byte.wonderhowto.com |
| 2025-08-14 2025 | Browser's XSS Filter Bypass Cheat SheetMasatokinugawa / filterbypass wiki intermediate 4 min read | Library for bypassing browser XSS filters, covering Chrome/Safari and IE11/Edge. It details techniques for exploiting XSS Auditor and IE/Edge XSS filters, including bypassing filters by inserting strings, leveraging character encodings, and exploiting JavaScript execution within various HTML contexts. Specific bypass methods are provided for scenarios involving SVG, XML, Flash, Angular, Vue.js, and jQuery, often requiring arbitrary tag injection and specific conditions related to same-origin policies or CORS. |
| 2025-08-14 2025 | XSS Cheat Sheet beginner 60 min read | Cheat sheet compiling numerous XSS vectors and payloads. It includes examples for triggering alerts via `onclick`, `onload`, `onerror`, and various other event handlers within HTML elements like `<svg>`, `<img>`, `<button>`, and `<input>`. The resource also demonstrates techniques using `data:` URIs, Unicode escapes, and string manipulation for obfuscation. |
| 2025-08-14 2025 | Sniping Insecure Cookies with XSS intermediate 10 min read | Analysis of an accounting web application reveals how insecure cookie handling, specifically lacking `HttpOnly` and `Secure` flags, combined with a Cross-Site Scripting (XSS) vulnerability, can lead to full account compromise. The session token, implemented as a JSON Web Token (JWT) and stored in a cookie accessible by JavaScript, was susceptible to theft. This enabled an attacker to hijack administrator sessions by capturing the token and potentially manipulating the JWT's user ID if the secret key were weak enough to brute-force. |
| 2025-08-14 2025 | xss-polyglots intermediate | The content provided is a title "xss-polyglots" without any additional information or context. It seems to refer to cross-site scripting (XSS) polyglots, which are payloads that can execute in multiple contexts or languages. The term may relate to security testing, web development, or cybersecurity. |
| 2025-08-14 2025 | qazbnm456/awesome-web-security beginner 23 min read SSRF | Library of curated web security materials and resources covering techniques for Cross-Site Scripting (XSS), Prototype Pollution, CSV Injection, SQL Injection, Command Injection, XXE, CSRF, SSRF, Web Cache Poisoning, and Open Redirects. It also includes resources on SAML, file uploads, Rails, AngularJS, ReactJS, SSL/TLS, and cloud security specific to AWS and Azure, with mentions of CVE-2019-7609. |
| 2025-08-14 2025 | asp.net - Bypass XSS blacklist "", "&" input nvarchar - Stack Overflow intermediate | Library for bypassing XSS blacklists on ASP.NET applications. This resource details a scenario where a blacklisting approach fails to prevent Cross-Site Scripting, even when character inputs like `<`, `>`, and `&` are blocked. The vulnerability arises because the application stores user input in `nvarchar` fields and later outputs it as JavaScript variables. While the JavaScript encoding escapes characters within the string variables, it does not prevent XSS when these variables are rendered into the HTML. → stackoverflow.com |
| 2025-08-14 2025 | tunz/js-vuln-db: A collection of JavaScript engine CVEs with PoCs advanced | "tunz/js-vuln-db" is a repository that contains a collection of Common Vulnerabilities and Exposures (CVEs) related to JavaScript engines, along with Proof of Concepts (PoCs). This resource is likely designed to provide a centralized location for researchers and developers to access information about vulnerabilities in JavaScript engines and explore practical demonstrations of these vulnerabilities. |
| 2025-08-14 2025 | Uber Bug Bounty: Turning Self-XSS into Good-XSS – Jack Whitton intermediate 4 min read | Writeup detailing the exploitation of a self-XSS vulnerability on Uber's Partners portal. The author demonstrates chaining this self-XSS with two CSRF vulnerabilities in Uber's OAuth login and logout flows. This chain allows an attacker to log a victim out of their Uber Partners session, log them into the attacker's account, execute malicious JavaScript in the victim's context, and then log them back into their own account, all while maintaining an active session for data exfiltration. The technique leverages Content Security Policy (CSP) to selectively block redirects and facilitate the cross-account session manipulation. |
| 2025-08-14 2025 | Cross-Site Script Inclusion - A Fameless but Widespread Web Vulnerability C intermediate 8 min read | Library for detecting and exploiting Cross-Site Script Inclusion (XSSI) vulnerabilities, which are often overlooked but can lead to sensitive data leakage, circumvention of token-based protection, and account compromise. The library aids penetration testers by identifying dynamic JavaScript and JavaScript accessible only when authenticated. It analyzes scripts, compares content before and after cookie removal, and highlights discrepancies, assisting in the discovery of vulnerabilities like those involving ambient-authority information in JSONP or sensitive data within global variables. |
| 2025-08-14 2025 | Respect XSS beginner 4 min read | Writeup detailing a cross-site scripting (XSS) vulnerability affecting both SharePoint on-premises and online versions. This vulnerability, which earned a $2500 bounty, is triggered by manipulating the `SiteName` GET parameter within the "Follow Site" feature, allowing for payloads like `-confirm(document.domain)-` to be injected. The writeup includes exploitation examples and a timeline of the vulnerability's reporting and resolution by Microsoft. |
| 2025-08-14 2025 | The misunderstood X-XSS-Protection beginner | The content seems to focus on the X-XSS-Protection header, which is a security feature designed to mitigate cross-site scripting (XSS) attacks on websites. However, the content itself is very brief and lacks specific details or explanations about the misunderstood aspects of the X-XSS-Protection header. It suggests that there may be misconceptions or confusion surrounding this security measure. |
| 2025-08-14 2025 | XSS Hunter beginner | XSS Hunter is a tool used for detecting cross-site scripting (XSS) vulnerabilities in web applications. It helps security professionals identify and remediate XSS vulnerabilities by simulating attacks and capturing exploit attempts. XSS Hunter assists in understanding how attackers can exploit XSS vulnerabilities and provides insights into potential security weaknesses in web applications. By using XSS Hunter, security teams can proactively address XSS vulnerabilities and enhance the overall security posture of their web applications. |
| 2025-08-14 2025 | XSS without HTML: Client-Side Template Injection with AngularJS : netsec advanced | The content discusses a security vulnerability known as Client-Side Template Injection with AngularJS, which can lead to cross-site scripting (XSS) attacks without the use of traditional HTML. This type of vulnerability allows attackers to inject malicious templates into AngularJS applications, potentially compromising user data and security. The article likely delves into the technical details and implications of this security issue within the context of web development and security. |
| 2025-08-14 2025 | Cross Site Scripting Payloads ≈ Packet Storm beginner 8 min read | Library of Cross-Site Scripting (XSS) payloads hosted on Packet Storm Security, offering a collection of common and less common injection strings. Users access this resource by agreeing to terms that govern intellectual property, user representations, prohibited activities, and data usage, with provisions for user-generated contributions and the site's proprietary content. |
| 2025-08-14 2025 | How I Stole Plunker Session Tokens With Angular Expressions intermediate 7 min read | Writeup detailing an Angular Expression Injection vulnerability in Plunker, allowing for Plunker session token theft. The exploit leverages user input within the Twitter title meta tag, which is then evaluated by AngularJS, to steal session IDs by embedding them in image tags that send requests to a controlled server. The vulnerability was quickly patched by adding `ng-non-bindable` to the meta tag. |
| 2025-08-14 2025 | XSS Payloads beginner | The content provided is a brief mention of "XSS Payloads." This likely refers to malicious code or scripts that are used in cross-site scripting (XSS) attacks. XSS payloads are designed to exploit vulnerabilities in web applications, allowing attackers to inject and execute their own code on a targeted website. These payloads can be used to steal sensitive information, manipulate content, or perform other malicious actions. It is important for web developers and security professionals to be aware of XSS payloads and implement measures to prevent such attacks. |