Is XSS dangerous on web without login/sensitive user's data?

Question

Is XSS dangerous when the web application doesn't have a login/register function, the user isn't logged in or when the website doesn't store any sensitive user information?

Answer 1

Of course!
False information could be inserted into a webpage with XSS. Imagine if Microsoft had a giant banner on their front page stating they would shut down the whole company, their shares could drop significantly, just because of a XSS attack, without anyone logging in.

Answer 2

XSS is still very dangerous because it can cause a user to reveal sensitive information that isn't even necessarily to the website that they are visiting.

It can be used to run scripts, modify the page, provide other information, cause redirects etc.

Answer 3

Ok Let's to clarify some scenarios then you judge

• someone found a XXS vuln in your Company Ticket System. Then he send a malicious link to them. So he can catch them privileges on the ticket system and read all of tickets (it could contains users,passwords,credits, etc) also he can catch the other Cookies.

• someone found XXS vuln then he send a malicious link with redirect script to them to malicious website. (he can use browser vuln to execute Trojans,backdoor,keylogger,etc)

• what if he found vuln in some public script which your customers use it then he did the previous attacks to your customers ?

Isn't Dangerous?