cross-site-scripting
Safeguard articles tagged "cross-site-scripting" — guides, analysis, and best practices for software supply chain and application security.
23 articles
Cross-site scripting (XSS) explained for developers
XSS has topped vulnerability lists for two decades. Here's how reflected, stored, and DOM-based XSS actually work, real incidents, and how to fix them.
XSS Code Examples: How Cross-Site Scripting Looks in Practice
An XSS code example makes the abstract concrete: here is what vulnerable code looks like for each type of cross-site scripting, and the small change that fixes each one.
CVE-2020-11023: XSS in jQuery option/script tag handling
CVE-2020-11023 let untrusted HTML with option tags bypass sanitization in jQuery's DOM methods, enabling XSS. Here's the fix, timeline, and remediation.
CVE-2015-9251: jQuery cross-domain AJAX XSS
CVE-2015-9251 lets attackers exploit jQuery's cross-domain AJAX handling to run arbitrary script. Learn affected versions, risk context, and fixes.
Cross-Site Scripting (XSS): A Prevention Guide
XSS lets an attacker run their JavaScript in your users' browsers — stealing sessions, rewriting pages, and pivoting to account takeover. This guide covers the three XSS types and the defenses that actually hold.
XSS Payloads on GitHub: What Those Repos Contain and How to Defend
Searching for XSS payloads on GitHub turns up huge lists of test strings. Here is what they are actually for, how defenders use them responsibly, and how to stop cross-site scripting in your own code.
An XSS Example That Explains How Cross-Site Scripting Works
A clear XSS example shows how unescaped user input becomes executable script in a victim's browser, and why output encoding and CSP are the fixes that hold.
DOM-Based XSS: Finding and Fixing Client-Side Injection
DOM XSS never touches your server, so response scanners miss it. Here is how to trace sources to sinks in client code and shut the flaw down.
Stored XSS: Why Persistent Injection Hurts Most
Stored XSS saves the attacker's script server-side and serves it to everyone. Here is why persistent injection is the most damaging XSS variant and how to stop it.
XSS Tutorial: How Cross-Site Scripting Works and How to Stop It
A defender's XSS tutorial covering the three attack types, why they still slip through, and the encoding and CSP controls that actually prevent them.
XSS Script Example: How Cross-Site Scripting Works and How to Stop It
A clear XSS script example shows how untrusted input becomes executable code in a victim's browser. Here is the anatomy of the three XSS types and the defenses that actually work.
How to Fix Cross-Site Scripting Vulnerabilities in Java (With Examples)
A practical walkthrough of how to fix cross site scripting vulnerabilities in Java: context-aware output encoding, template auto-escaping, and where servlet code goes wrong.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.