<div><h3 style="box-sizing:border-box;margin:0px 15px 8px 0px;font-weight:500;font-size:24px;text-overflow:ellipsis;overflow:hidden;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Summary </h3><p style="box-sizing:border-box;margin-top:0px;margin-bottom:1rem;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;"> </p><h3 style="box-sizing:border-box;margin:0px 15px 8px 0px;font-weight:500;font-size:24px;text-overflow:ellipsis;overflow:hidden;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Explanation </h3><p style="box-sizing:border-box;margin-top:0px;margin-bottom:1rem;font-family:Roboto, &quot;Helvetica Neue&quot;, Helvetica, Arial, sans-serif;text-align:left;">Cross-site scripting (XSS) vulnerabilities occur when:<br style="box-sizing:border-box;"><br style="box-sizing:border-box;">1. Data enters a web application through an untrusted source. In the case of reflected XSS, the untrusted source is typically a web request, while in the case of persisted (also known as stored) XSS it is typically a database or other back-end data store.<br style="box-sizing:border-box;"><br style="box-sizing:border-box;"><br style="box-sizing:border-box;">2. The data is included in dynamic content that is sent to a web user without validation.<br style="box-sizing:border-box;"><br style="box-sizing:border-box;">The malicious content sent to the web browser often takes the form of a JavaScript segment, but can also include HTML, Flash or any other type of code that the browser executes. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data such as cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. </p><br> </div>