`, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?","text":"A security analyst reviews web application logs and observes client-side script payloads, such as ``, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?","inLanguage":"en","acceptedAnswer":{"@type":"Answer","text":"Cross-Site Scripting (XSS)","answerExplanation":{"@type":"Comment","text":"Cross-Site Scripting (XSS) is present because client-side JavaScript payloads are injected through user input and executed within victim browsers. Cross-Site Scripting (XSS) occurs when an application includes unvalidated data in a web page delivered to a browser, enabling attackers to execute client-side scripts in victim user sessions."}},"eduQuestionType":"Multiple choice","isAccessibleForFree":true},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Examkin","item":"https://examkin.com/en"},{"@type":"ListItem","position":2,"name":"CompTIA Security+","item":"https://examkin.com/en/exams/comptia-security-plus"},{"@type":"ListItem","position":3,"name":"Threats, Vulnerabilities, and Mitigations","item":"https://examkin.com/en/exams/comptia-security-plus/t/SECURITY_CORE__threats_vulnerabilities_and_mitigations"},{"@type":"ListItem","position":4,"name":"Application and Software Vulnerabilities","item":"https://examkin.com/en/exams/comptia-security-plus/t/SECURITY_CORE__threats_vulnerabilities_and_mitigations__application_and_software_vulnerabilities"},{"@type":"ListItem","position":5,"name":"Question","item":"https://examkin.com/en/exams/comptia-security-plus/q/e3dc5880-d302-4705-a9b8-43d50f80397d"}]}]

A security analyst reviews web application logs and observes client-side script payloads, such as `<script>document.cookie</script>`, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?

1. Cross-Site Scripting (XSS)Answer
2. B
   SQL Injection (SQLi)
3. C
   Broken Authorization
4. D
   Network Layer Firewall Failure

Answer

Cross-Site Scripting (XSS) is present because client-side JavaScript payloads are injected through user input and executed within victim browsers.

Cross-Site Scripting (XSS) occurs when an application includes unvalidated data in a web page delivered to a browser, enabling attackers to execute client-side scripts in victim user sessions.

Step-by-Step Solution

1

Analyze the log payload and target execution context

The log entry contains HTML `<script>` tags executing JavaScript in the victim's browser context.

Distinguishing between server-side database commands and client-side browser scripts identifies the vulnerability class.

2

Match the behavior to the software vulnerability definition

Injecting malicious scripts into web application parameters that run in another user's browser corresponds directly to Cross-Site Scripting (XSS).

XSS specifically exploits improper input sanitization and output encoding on client-facing web application fields.

Key Concept

Cross-Site Scripting (XSS)

Common Mistakes