I'm wondering if we can consider the injection of HTML tags like a
, image
, img
, video
, audio
, marquee
or iframe
without an event attribute as XSS? Since no JavaScript is involved and therefor no JavaScript code is included and executed. But an (external) resource is loaded or in case of the marquee
tag an animation is triggered (often screwing up the template). As well as for the a
-tag the risk of being able to include clickable URL's.
So is a pure HTML injection (even if it breaks something like an input field) considered as valid XSS, and what would be the motivation to explain that it is valid XSS?
A few examples:
"><marquee>123
"><img src=http://example.com/a.jpg
<a href=//example.com>123</a>