Tag Info

New answers tagged


The address bar doesn't do anything. It's the web application which appearently takes the URL and inserts it right into the HTML markup, leading to a cross-site scripting vulnerability. This happens either server-side or client-side: Either the PHP script delivers the page with the URL already in it, or there's a piece of JavaScript code which injects the ...


That is the same as filling a form which has an input field named page with the following data text-file-viewer.php/"><script>alert("test");</script> If you get the alert pop-up, the server is writing the user input as is.

Top 50 recent answers are included