I realize someone is putting cryptominer on my pages. If I delete it several days later it returns.
My question is, how is it possible for an attacker to inject code directly into the document? Wouldn't you require server credentials to access and edit files on the server?
Is this possible with XSS attacks?