Which vulnerability type is described as enabling attacker-executed scripts within a user's browser?

Which vulnerability type is described as enabling attacker-executed scripts within a user's browser?

• A. Buffer overflow
• B. SQL injection
• C. Cross-site scripting (XSS)
• D. Cross-site request forgery (CSRF)

Answer: (C)

Cross-site scripting is when attacker-supplied scripts are run by the victim’s browser in the context of the trusted site. The browser treats the injected code as if it came from the site itself, so it can access the user’s data (like cookies or tokens), read or modify page content, or perform actions on behalf of the user. This happens when an application takes input from users and includes it in a web page without proper sanitization or encoding, or when data from the user is dynamically added to the DOM. Buffer overflow involves overflowing memory to change what code runs, usually at the system level. SQL injection targets database queries to manipulate data. CSRF tricks a user into submitting a request while authenticated, without necessarily running scripts in the user’s browser. Since the described scenario centers on attacker-executed scripts inside the user’s browser, the correct vulnerability is cross-site scripting.

Cross-site scripting is when attacker-supplied scripts are run by the victim’s browser in the context of the trusted site. The browser treats the injected code as if it came from the site itself, so it can access the user’s data (like cookies or tokens), read or modify page content, or perform actions on behalf of the user. This happens when an application takes input from users and includes it in a web page without proper sanitization or encoding, or when data from the user is dynamically added to the DOM.

Buffer overflow involves overflowing memory to change what code runs, usually at the system level. SQL injection targets database queries to manipulate data. CSRF tricks a user into submitting a request while authenticated, without necessarily running scripts in the user’s browser. Since the described scenario centers on attacker-executed scripts inside the user’s browser, the correct vulnerability is cross-site scripting.