A municipal app reflects user input into HTML responses without encoding. How should the tester classify the primary risk theme?
Select an answer to reveal the explanation.
Short Explanation
If the page echoes your input straight into HTML, a victim’s browser may treat attacker-controlled bits as code. That is the reflected XSS story — how bad it gets still depends on where it lands and what cookies or tokens are in play. It is not “just CSS.”
Full Explanation
Reflected cross-site scripting arises when untrusted input is returned in HTML without proper encoding or contextual escaping and then executes in a victim’s browser. Impact severity depends on sink context, cookie flags, CSP, and what actions a session can perform. Reflection alone does not automatically equal stored XSS in admin panels. Classification should identify the XSS class and frame impact honestly for the civic application’s session model.