I have received a report from a client that lists XSS vulnerabilities. The report shows reflected XSS vulnerabilities. In each vulnerability, the payload reflected is a single, unclosed <qss>

Normally, when I read about xss vulnerabilities I see a lot of payloads that will try to close an apostraphe or an input tag, and then inject a <script> tag or some arbitrary javascript.

What is the significance of the <qss> tag and how can it be used in an xss attack? The only thing I've uncovered with google is that it is a qt style sheet, but I still don't understand its role in XSS

1 Answer 1


This appears to be a tag inserted by Qualys WAS (Web Application Scanning) engine.

<qss> tags are inserted as input in order to test whether these are encoded correctly as output.

This approach is safer on a live system that testing using <script> tags, which may have unintended consequences as a result of the scan becase the <qss> tags will be ignored by any browser.

  • this is correct. <qss> is a safe way to verify that angle brackets are allowed to be submitted and rendered as is in the final output.
    – mcgyver5
    Jan 5, 2015 at 18:33
  • Our cloudflare based firewall blocks dangerous elements like script, img in input, but it doesn't block qss tag. And qualys tag has raised this as a confirmed vulnerability. I don't think this as a vulnerability. How can I resolve this?
    – Sahil
    May 12, 2020 at 12:59
  • @sahil It's not wise to rely on a WAF like CloudFlare to secure your application. Bypasses are found all the time which will allow script code in. It's recommended to fix your app so even qss tags can't be injected and output as tags. By all means, use CloudFlare as an extra layer, but you should scan and secure your application outside of it. Oct 2, 2020 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.