Weakness

Cross-site scripting

XSS

Getting a website to run an attacker's JavaScript in other visitors' browsers.

If a site echoes input into its pages without escaping it, an attacker can inject a script that runs as the site for anyone who views the page, stealing sessions or acting on the victim's behalf.

Cross-site scripting in the news

Siemens Industrial Edge App Publisher

CISA Advisories3d agoAppSecVulnerabilitiesCVE-2026-78556 CVE-2026-78557

Satel Netco Design

CISA Advisories17d agoVulnerabilitiesCVE-2026-105269

Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data

CISA Advisories17d agoThreat IntelAppSecVulnerabilities

CRLF-Powered Desync Attacks: Beheading HTTP Streams

PortSwigger Research81d agoAppSec

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit

Proofpoint Threat Insight88d agoThreat IntelAppSecVulnerabilitiesCVE-2026-42897

The weakness behind it

Its CWE entry, with CVEs in the news, attacker techniques and the controls that stop it.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Input is echoed into a web page as script, running in other users' browsers with their session.

Plain-language explainers written by SecurityTabs, matched to stories by name. All terms