XSS

Injecting malicious scripts into web pages viewed by other users.

XSS injects malicious script into web content so it runs in the browsers of other users, enabling session token theft, defacement, or redirection. It commonly appears as stored, reflected, or DOM-based variants depending on where the untrusted input is handled. The core defenses are context-aware output encoding, input validation, and a content security policy. A common exam distinction is that XSS targets the user's browser, whereas SQL injection targets the back-end database.