A citizen-comment portal reflects unsanitized input into pages other residents view, and a crafted script steals session cookies from those browsers. Which vulnerability is demonstrated?
Select an answer to reveal the explanation.
Short Explanation
If a comment box can run script in someone else’s browser and swipe cookies, that is XSS — the page becomes the attacker’s stage. It is not SQLi against the database engine or a poisoned vendor patch. Sanitize and encode output on civic portals.
Full Explanation
Cross-site scripting injects script into content rendered for other users, often to steal sessions or perform actions as the victim. Objective 2.3 identifies XSS as a web vulnerability distinct from SQL injection. Supply-chain malicious updates and unsupported OS kiosks are different vulnerability or vector themes. Citizen portals should encode output, apply CSP where appropriate, and avoid reflecting raw input.