Cross-site scripting · Question 12 of 12
A guestbook outputs entries with <f:format.raw>. A visitor saves a script that every reader executes. Which classifications are correct?
2 answers are correct. Hard
Show answer
Answer
- B OWASP category Injection
- D Stored XSS
Explanation
The payload is stored and hits every later reader, so it is stored XSS. The OWASP Top 10 count XSS in the category Injection. Reflected XSS would require a prepared link.